Critical severity · published Jul 1, 2022
CVE-2022-25898
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or…
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jsrsasign · Kjur
4.8.0 before 10.5.25 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25898
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25898
Patch
https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41
Release Notes
https://github.com/kjur/jsrsasign/releases/tag/10.5.25
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896
Exploit
https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122
More from Jsrsasign
9.8
CVE-2020-14968
An issue was discovered in the jsrsasign package before 8.0.17 for Node.js
9.8
CVE-2020-14967
An issue was discovered in the jsrsasign package before 8.0.18 for Node.js
9.1
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation
9.1
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and…
9.1
CVE-2026-4600
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in…