CVE Vulnerability

CVE-2022-25898

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/kjur/jsrsasign/releases/tag/10.5.25 Release Notes Third Party Advisory
https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122 Exploit Patch
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898 Exploit Patch
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896 Exploit Patch
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897 Exploit Patch
https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:jsrsasign_project:jsrsasign:*:*:*:*:*:node.js:*:*
Information

Published : 2022-07-01 08:15

Updated : 2022-07-13 07:01

NVD link : CVE-2022-25898

Mitre link : CVE-2022-25898

Products Affected
No products.
CWE
CWE-347

Improper Verification of Cryptographic Signature