Dashboard / CVE-2025-47222

CVE-2025-47222

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 73/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: Low

Description

A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class path and the provided class is not expected to return different errors if the class exists in deployment or not. This returns information about the classes loaded in the application or not to the clientside.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
keyfactor signserver < 7.3.1

References & Advisories (3)

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — Exploitation Probability

0.32%
Raw Score 0.003180
Percentile 25.1%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00318
2026-11-13
0.00318
2026-11-12
0.00318
2026-11-10
0.00318
2026-11-09
0.00318
2026-11-08
0.00318
2026-11-07
0.00318
2026-11-06
0.00318
2026-11-05
0.00318

Intelligence Sources

nvd ref →

External Links