# CVE-2022-24738: GO-2022-0348 - Account compromise in Evmos in github.com/tharsis/evmos

Source: https://junglewise.ai/threats/cve-2022-24738-account-compromise-in-evmos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-21  
License: CC BY 4.0 with a link back

CVE-2022-24738 · Severity: low · CVSS 3.1 · Published 2024-08-21

Account compromise in Evmos in github.com/tharsis/evmos

Technologies: [github.com/tharsis/evmos (Go)](https://junglewise.ai/threats/technologies/github-com-tharsis-evmos). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2022-24738 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-24738 being exploited in the wild.

**How severe is CVE-2022-24738?** Low severity, with a CVSS score of 3.1, published 21 August 2024.

**Which products and versions are affected?** github.com/tharsis/evmos (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.0.1; github.com/tharsis/evmos/v2 (Go) SEMVER:introduced=0,fixed=2.0.1.

**Is there a fix for CVE-2022-24738?** Yes. github.com/tharsis/evmos (Go): upgrade to 2.0.1 or later; github.com/tharsis/evmos/v2 (Go): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-24738?** Check whether you run github.com/tharsis/evmos (Go) or github.com/tharsis/evmos/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/tharsis/evmos (Go): upgrade to 2.0.1 or later

  ```sh
  go get github.com/tharsis/evmos@v2.0.1
  ```

- github.com/tharsis/evmos/v2 (Go): upgrade to 2.0.1 or later

  ```sh
  go get github.com/tharsis/evmos/v2@v2.0.1
  ```


## Affected products

- github.com/tharsis/evmos (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.0.1
- github.com/tharsis/evmos/v2 (Go) SEMVER:introduced=0,fixed=2.0.1

## Identifiers

- CVE-2022-24738
- GHSA-5jgq-x857-p8xw
- GO-2022-0348

## Related threats

- [Evmos transaction execution not accounting for all state transition after interaction with precompiles](https://junglewise.ai/threats/cve-2024-32644-evmos-transaction-execution-not-accounting-for-all-state)
- [Drainage of FeeCollector's Block Transaction Fees in cronos](https://junglewise.ai/threats/cve-2021-43839-drainage-of-feecollector-s-block-transaction-fees-in-cronos)