Is CVE-2024-45304 actively exploited?

No active exploitation of CVE-2024-45304 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-45304 be exploited remotely?

Yes. CVE-2024-45304 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-45304?

CVE-2024-45304 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2024-45304

MEDIUM

CVE-2024-45304

CWE-670Published: August 31, 2024· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership transfer, contrary to the original owner's intention of leaving the contract without an owner. It introduces a security risk where an unintended party (pending owner) can gain control of the contract after the original owner has renounced ownership. This could also be used by a malicious owner to simulate leaving a contract without an owner, to later regain ownership by previously having proposed himself as a pending owner. This issue has been addressed in release version 0.16.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

NVD Source

Technical Analysis

CVE-2024-45304 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.