PT-2022-22596 · Renato · Renato

J-Gainsec · Published 2022-08-04 · Updated 2022-08-10 · CVE-2022-35142

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Renato version 0.17.0

Description The issue allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter. Additionally, Renato employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. There is also a cross-site scripting (XSS) vulnerability present in version 0.17.0.

Recommendations For version 0.17.0, update to version 0.17.1 to resolve the security issues, including the Denial of Service, weak password complexity, and cross-site scripting vulnerabilities. As a temporary workaround, consider restricting access to the Search parameter to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

XSS

Weakness Enumeration

CWE-287

CWE-79

CWE-521

Related Identifiers

CVE-2022-35142

GHSA-7942-2FX8-QHPF

GHSA-VC68-6X72-W22F

GHSA-XXC2-J7JJ-6G5M

Affected Products

Renato

References · 19

• 🔥 https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144 · Exploit
• https://osv.dev/vulnerability/GHSA-vc68-6x72-w22f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xxc2-j7jj-6g5m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35142 · Security Note
• https://osv.dev/vulnerability/GHSA-7942-2fx8-qhpf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35144 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35143 · Security Note
• https://github.com/gilbitron/Raneto/releases · Note
• https://github.com/ryanlelek/Raneto/pull/370 · Note
• https://github.com/ryanlelek/Raneto/issues/368 · Note
• https://github.com/ryanlelek/Raneto/commit/55e442c9bc67b845094e14ceb228e95c639595be · Note
• https://github.com/ryanlelek/Raneto · Note
• https://github.com/ryanlelek/Raneto/releases/tag/0.17.1 · Note
• https://cwe.mitre.org/data/definitions/521.html · Note