CVE-2022-35143 Raneto v0.17.0 employs weak password complexity requirements
Weak password complexity in Renato allows attackers to crack user passwords via brute-force attacks, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-35143?
CVE-2022-35143 is a critical vulnerability in n/a, published on 4 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
Weakness: CWE-521
Which versions are affected by CVE-2022-35143?
2 open source packages ship an affected version, including raneto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
raneto npm | All versions | 0.17.1 |
raneto npm | All versions | 0.17.1 |
Products include Raneto Project Raneto.
How do I fix CVE-2022-35143?
Upgrade raneto to 0.17.1 or later.
Is CVE-2022-35143 being exploited?
There is no known exploitation of CVE-2022-35143 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7942-2fx8-qhpf.