Raneto v0.17.0 employs weak password complexity requirements

Description

Raneto v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. Version 0.17.1 contains security mitigations for this and other vulnerabilities.

Recommendation

Update the raneto package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.17.0
• Patched version(s): 0.17.1

References

• GHSA-7942-2fx8-qhpf
• cwe.mitre.org
• gainsec.com
• raneto.com
• CVE-2022-35143
• CWE-521
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Raneto Denial of Service via crafted payload injected into `Search` parameter - CVE-2022-35142
• steal Inefficient Regular Expression Complexity vulnerability via string variable - CVE-2022-37259
• Raneto vulnerable to Cross-site Scripting - CVE-2022-35144
• Inefficient Regular Expression Complexity in marked (GHSA-5v2h-r2cx-5xgj) - CVE-2022-21681

Tags:

npm

raneto