Description

An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.

Remediation

References

http://raneto.com/

https://cwe.mitre.org/data/definitions/703.html

https://github.com/gilbitron/Raneto/releases

https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144/

Related Vulnerabilities

CVE-2021-32702 Vulnerability in npm package nextjs-auth0

CVE-2020-15256 Vulnerability in npm package object-path-set

CVE-2020-17533 Vulnerability in maven package org.apache.accumulo:accumulo-core

CVE-2019-10754 Vulnerability in maven package org.apereo.cas:cas-server-core-services-api

CVE-2020-7608 Vulnerability in npm package yargs-parser

Severity

High

Classification

CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Product Third Party Advisory Exploit Patch