CVE-2022-25898

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Improper Verification of Cryptographic Signature pada kjur jsrsasign. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.

Rincian

Terbit di NVD

1 Juli 2022

Terakhir diubah

22 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122 exploit · patch · advisory pihak ketiga
• https://github.com/kjur/jsrsasign/releases/tag/10.5.25 release notes · advisory pihak ketiga