CVE-2022-24773

mediumpriority · track · 21EPSS 0.010 · 61 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.96% (61st) EPSS

CVSS 5 · medium

Is it mine?

27 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · scored 2026-10-27

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · security-advisories@github.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347USCWE-347US

affected products (27)

Products and version ranges known to be affected.

Atlassian Bitbucket <10.0.2all versionscert_bundDE
Atlassian Bitbucket <8.19.25 (LTS)all versionscert_bundDE
Atlassian Bitbucket <9.4.13 (LTS)all versionscert_bundDE
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM Sterling Connect:Direct Web Servicesall versionscert_bundDEcpe:/a:ibm:sterling_connect%3adirect:web_services
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat OpenShift Data Foundation <4.18all versionscert_bundDE
Red Hat OpenShift Data Foundation <4.19all versionscert_bundDE
Red Hat OpenShift Service Mesh <2.1.2.1all versionscert_bundDE
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Splunk Splunk Enterprise <10.0.1all versionscert_bundDE
Splunk Splunk Enterprise <9.2.8all versionscert_bundDE
Splunk Splunk Enterprise <9.3.6all versionscert_bundDE
Splunk Splunk Enterprise <9.4.4all versionscert_bundDE
Atlassian Bitbucket< 10.0.2cert_bundDE
Atlassian Bitbucket< 8.19.25 (LTS)cert_bundDE
Atlassian Bitbucket< 9.4.13 (LTS)cert_bundDE
Red Hat OpenShift≤ Data Foundation <4.19cert_bundDE
Red Hat OpenShift≤ Data Foundation <4.18cert_bundDE
Red Hat OpenShift≤ Service Mesh <2.1.2.1cert_bundDE

showing 20 of 27

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-0417Red Hat OpenShift Service Mesh: Mehrere SchwachstellenDeutsch2022-05-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
GHSA-2r2c-g63r-vccrImproper Verification of Cryptographic Signature in `node-forge`2022-03-18ghsa · osvUS
### Impact RSA PKCS#1 v1.5 signature verification code is not properly checking `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. ### Patches The issue has been addressed in `node-forge` `1.3.0`. ### For more information If you have any questions or comments about this advisory: * Open an issue in [forge](https://github.com/digitalbazaar/forge) * Email us at [example email address](mailto:security@digitalbazaar.com)

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2022-03-18modified 2026-06-17

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan