1. Home
  2. CVE Database
  3. CVE-2022-25898
HIGH · 7.7

CVE-2022-25898

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped chara...

Vulnerability Description

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.

CVSS Score

7.7

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
HIGH

Affected Products

VendorProductVersions
Jsrsasign ProjectJsrsasign>= 4.8.0, < 10.5.25

Related Weaknesses (CWE)

CWE-347

References

FAQ

What is CVE-2022-25898?

CVE-2022-25898 is a vulnerability with a CVSS score of 7.7 (HIGH). The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped chara...

How severe is CVE-2022-25898?

CVE-2022-25898 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-25898?

Check the references section above for vendor advisories and patch information. Affected products include: Jsrsasign Project Jsrsasign.