CVE-2022-25898: kjur jsrsasign
Vulnerability summary
CVE-2022-25898 is a critical (CVSS 9.8) vulnerability in kjur jsrsasign. EPSS estimates a 1.15% chance of exploitation in the next 30 days, higher than 66.4% of scored vulnerabilities. 4 public exploits are recorded.
Timeline
- 01-07-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA7.7HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H/E:PDiffers
- OSV · NpmEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NDiffers
EPSS trend
Probability
1.15%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
0.00 pp
From 1.15% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Kjur1 product
- jsrsasign≥ 4.8.0, < 10.5.25
Npm1 product
- jsrsasign≥ 4.8.0, < 10.5.25
2 vendors · 2 products
References
9 links- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897X Refsource MISCWEBExploitPatchThird Party Advisory
- github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41X Refsource MISCWEBPatchThird Party Advisory
- github.com/kjur/jsrsasignPACKAGE