Vulnerability Description
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tryton | Proteus | >= 5.0.0, < 5.0.12 |
| Tryton | Trytond | >= 5.0.0, < 5.0.46 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://bugs.tryton.org/issue11219ExploitIssue TrackingVendor Advisory
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing ListThird Party Advisory
- https://www.debian.org/security/2022/dsa-5098Third Party Advisory
- https://www.debian.org/security/2022/dsa-5099Third Party Advisory
- https://bugs.tryton.org/issue11219ExploitIssue TrackingVendor Advisory
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing ListThird Party Advisory
- https://www.debian.org/security/2022/dsa-5098Third Party Advisory
- https://www.debian.org/security/2022/dsa-5099Third Party Advisory
FAQ
What is CVE-2022-26661?
CVE-2022-26661 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (pro...
How severe is CVE-2022-26661?
CVE-2022-26661 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-26661?
Check the references section above for vendor advisories and patch information. Affected products include: Tryton Proteus, Tryton Trytond, Debian Debian Linux.