{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T18:47:47.558","vulnerabilities":[{"cve":{"id":"CVE-2022-25898","sourceIdentifier":"report@snyk.io","published":"2022-07-01T20:15:08.023","lastModified":"2024-11-21T06:53:11.150","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method."},{"lang":"es","value":"El paquete jsrsasign versiones anteriores a 10.5.25, es vulnerable a una Verificación Inapropiada de la Firma Criptográfica cuando la firma JWS o JWT con caracteres especiales de codificación no Base64URL o con caracteres de escape de número puede ser comprobada como válida por error. Mitigación: Comprobar la firma JWS o JWT si presenta Base64URL y cadena de puntos segura antes de ejecutar el método JWS.verify() o JWS.verifyJWT()"}],"metrics":{"cvssMetricV31":[{"source":"report@snyk.io","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.3},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jsrsasign_project:jsrsasign:*:*:*:*:*:node.js:*:*","versionStartIncluding":"4.8.0","versionEndExcluding":"10.5.25","matchCriteriaId":"A9908067-61CF-448E-B741-76C7D0C8A118"}]}]}],"references":[{"url":"https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41","source":"report@snyk.io","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/10.5.25","source":"report@snyk.io","tags":["Release Notes","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898","source":"report@snyk.io","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897","source":"report@snyk.io","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896","source":"report@snyk.io","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122","source":"report@snyk.io","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/kjur/jsrsasign/releases/tag/10.5.25","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]}]}}]}