CVE-2022-35142 : An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the S

An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.

Published 2022-08-04 20:15:20

Updated 2022-08-10 16:32:07

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilegeDenial of service

Products affected by CVE-2022-35142

Raneto Project » Raneto » For Node.js
Versions before (<) 0.17.1
cpe:2.3:a:raneto_project:raneto:*:*:*:*:*:node.js:*:*
Matching versions

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

https://cwe.mitre.org/data/definitions/703.html

CWE - CWE-703: Improper Check or Handling of Exceptional Conditions (4.13)
Third Party Advisory
http://raneto.com/

Raneto - Markdown Knowledgebase for Node.js
Product

CVEs referencing this url
https://github.com/gilbitron/Raneto/releases

Releases · ryanlelek/Raneto
Third Party Advisory

CVEs referencing this url
https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144/

CVE-2022-35142, CVE-2022-35143, CVE-2022-35144 - DoS, XSS and Weak Password Policy in Renato a Markdown powered knowledge base - GainSec
Exploit;Patch;Third Party Advisory

CVEs referencing this url

Jump to