7.5

CVE-2022-26662

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

Data is provided by the National Vulnerability Database (NVD)
Tryton ≫ Proteus Version >= 5.0.0 < 5.0.12
Tryton ≫ Proteus Version >= 6.0.0 < 6.0.5
Tryton ≫ Proteus Version >= 6.2.0 < 6.2.2
Tryton ≫ Trytond Version >= 5.0.0 < 5.0.46
Tryton ≫ Trytond Version >= 6.0.0 < 6.0.16
Tryton ≫ Trytond Version >= 6.2.0 < 6.2.6
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 5.59% 0.899
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

https://bugs.tryton.org/issue11244
Patch
Vendor Advisory