CVE-2022-25898

 

Published at: - 01-07-2022 10:15

Last modified: - 13-07-2022 09:01

Total changes: - 2

Description

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• N/A-Release Notes, Third Party Advisory
• N/A-Exploit, Patch, Third Party Advisory
• N/A-Exploit, Patch, Third Party Advisory
• N/A-Exploit, Patch, Third Party Advisory
• N/A-Exploit, Patch, Third Party Advisory
• N/A-Patch, Third Party Advisory

 

Keywords

NVD

 

CVE-2022-25898

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures