CVE-2022-25898
Assigner: snyk
Published: 2022-07-01T00:00:00
State: PUBLISHED
affected: product: jsrsasign
vendor: n/a
versions: lessThan: 10.5.25
status: affected
version: unspecified
versionType: custom
credits: value: Adi Malyanker
value: Or David
datePublic: 2022-07-01T00:00:00
descriptions: value: The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 7.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H/E:P
version: 3.1
problemTypes: descriptions: description: Improper Verification of Cryptographic Signature
type: text
title: Improper Verification of Cryptographic Signature