Is CVE-2022-35144 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-35144 being exploited in the wild.

How severe is CVE-2022-35144?

Low severity, with a CVSS score of 3.1, published 5 August 2022.

Which products and versions are affected?

raneto (npm) SEMVER:introduced=0,fixed=0.17.1.

Is there a fix for CVE-2022-35144?

Yes. raneto (npm): upgrade to 0.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-35144 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-35144?

Check whether you run raneto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-35144: Raneto cross-site scripting vulnerability

CVE-2022-35144 · Severity: low · CVSS 3.1 · Published 2022-08-05

Raneto is a popular open-source knowledge base and wiki platform. A cross-site scripting (XSS) vulnerability in version 0.17.0 and earlier could allow authenticated administrators to inject malicious scripts through search fields and file paths, potentially compromising user sessions or data when those pages are viewed by others. The vulnerability requires administrative access and user interaction, limiting its immediate risk but still requiring prompt patching.

Technologies: raneto (npm). Vendors: npm.

Quick answers

Is CVE-2022-35144 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-35144 being exploited in the wild.
How severe is CVE-2022-35144?: Low severity, with a CVSS score of 3.1, published 5 August 2022.
Which products and versions are affected?: raneto (npm) SEMVER:introduced=0,fixed=0.17.1.
Is there a fix for CVE-2022-35144?: Yes. raneto (npm): upgrade to 0.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-35144 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-35144?: Check whether you run raneto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

raneto (npm): upgrade to 0.17.1 or later
```
npm install raneto@0.17.1
```

Technical details

Raneto v0.17.0 and earlier contains a reflected/stored cross-site scripting (CWE-79) vulnerability in search sanitization and file path handling. The vulnerability allows authenticated administrators to inject unsanitized HTML/JavaScript through search functionality and page administration actions. An attacker with admin credentials can craft malicious payloads that execute in the browser context of users viewing affected pages. The issue is mitigated by the requirement for high-privilege (admin) access and user interaction (viewing a malicious page). The vulnerability was fixed in version 0.17.1, which implements proper HTML escaping and strips raw HTML in favor of Markdown-only content for new/updated pages.

Affected products

Ryan Lelek Raneto 0.17.0 and earlier; fixed in 0.17.1

Identifiers

CVE-2022-35144
GHSA-vc68-6x72-w22f

Timeline

2022-08-04: disclosed: Vulnerability disclosed by J-GainSec
2022-08-04: patched: Fixed in version 0.17.1 with security update PR #370

References

https://github.com/ryanlelek/Raneto/pull/370

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.