dbcve.org
SignserverApplication · Keyfactor

CVE-2025-47222

MEDIUM · 6.5 CVSS v3.1 Published 2025-11-13
Fix available
A fix is available. Upgrade to 7.3.1 or later.
See remediation →
74/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class path and the provided class is not expected to return different errors if the class exists in deployment or not. This returns information about the classes loaded in the application or not to the clientside.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Keyfactor SignServer versions before 7.3.2 allow class name enumeration through properties that accept class paths. The application returns different error messages depending on whether a provided class name exists in the deployment, leaking information about loaded classes to unauthenticated or authenticated users.

MitigationUpgrade Keyfactor SignServer to version 7.3.2 or later which addresses the class name enumeration issue.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
SignserverApplication
Affected:< 7.3.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify if Keyfactor SignServer is installed
    Check for SignServer processes or installation directories. Common paths include /opt/signserver, /opt/keyfactor/signserver, or check running Java processes for signserver. Review web server configurations for signserver applications.
    Affected if Keyfactor SignServer is present in the environment
  2. Determine the installed SignServer version
    Check the SignServer version by inspecting the signserver/build.properties or signserver/version file in the installation directory. Alternatively, access the SignServer admin interface and look for version information in the About or System status pages.
    Affected if The installed version is less than 7.3.2 (specifically < 7.3.1)
  3. Locate endpoints accepting class path parameters
    Review SignServer configuration files (signserver.properties, signserver-deployed.properties) for properties that accept class names or class paths. Common patterns include crypto worker implementations, validator configurations, or custom extension properties.
    Affected if Properties accepting class names are configured in the SignServer deployment
  4. Test for class enumeration via error message differences
    Send requests with valid and invalid class names to endpoints that accept class path parameters. Compare the error responses. A vulnerable endpoint will return different error messages (e.g., ClassNotFoundException vs invalid parameter) depending on whether the class exists in the classpath.
    Affected if Different error messages are returned for valid versus invalid class names, leaking information about loaded classes

The environment is affected if Keyfactor SignServer version 7.3.1 or earlier is running and endpoints accepting class names return different error messages based on class existence.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 7.3.1 or later
Fixed in 7.3.1
Interim mitigation

Upgrade Keyfactor SignServer to version 7.3.2 or later which addresses the class name enumeration issue.

Recommended fix Moderate confidence

SignServer 7.3.2 or later

  1. 1. Identify the current SignServer version by checking the administration interface or running: signserver getinfo
  2. 2. Download SignServer version 7.3.2 or later from the official Keyfactor download portal at docs.keyfactor.com
  3. 3. Review the SignServer upgrade guide for your specific deployment type
  4. 4. Create a complete backup of the current SignServer configuration and database
  5. 5. Stop the SignServer services
  6. 6. Install SignServer 7.3.2 following the standard upgrade procedure
  7. 7. Start SignServer services and verify successful startup
  8. 8. Test that class path properties no longer return different error messages based on whether a class exists
Caveat Review the SignServer 7.3.2 release notes for any configuration or behavioral changes before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Signserver Scoped from the published advisory
  • Consultation2.0 h
  • Implementation1.0 h
  • Testing4.0 h
  • Review / QA2.0 h
9.0 hours of engineering $1,540
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,464.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-47222 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-47222 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data