CVE-2022-38493

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-384957.8LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.CVE-2022-384965.5LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.CVE-2022-384975.5LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.CVE-2022-38504.3The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a lCVE-2022-385099.8Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php.CVE-2022-385107.8Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList.CVE-2022-385117.8TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi.CVE-2022-385126.5The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions befCVE-2022-38526.5The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to misCVE-2022-385276.1UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.CVE-2022-385286.5Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporterCVE-2022-385297.8tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.
CVE-2022-38493: High severity, CVSS 7.5 | Vulnix