Vulnerability Description
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tryton | Proteus | >= 5.0.0, < 5.0.12 |
| Tryton | Trytond | >= 5.0.0, < 5.0.46 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://bugs.tryton.org/issue11244PatchVendor Advisory
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing ListThird Party Advisory
- https://www.debian.org/security/2022/dsa-5098Third Party Advisory
- https://www.debian.org/security/2022/dsa-5099Third Party Advisory
- https://bugs.tryton.org/issue11244PatchVendor Advisory
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing ListThird Party Advisory
- https://www.debian.org/security/2022/dsa-5098Third Party Advisory
- https://www.debian.org/security/2022/dsa-5099Third Party Advisory
FAQ
What is CVE-2022-26662?
CVE-2022-26662 is a vulnerability with a CVSS score of 7.5 (HIGH). An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (C...
How severe is CVE-2022-26662?
CVE-2022-26662 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-26662?
Check the references section above for vendor advisories and patch information. Affected products include: Tryton Proteus, Tryton Trytond, Debian Debian Linux.