CVE-2022-26661

Опубликовано: 10 мар. 2022

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

Ссылки

https://bugs.tryton.org/issue11219
Exploit
Issue Tracking
Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2022/dsa-5098
Third Party Advisory
https://www.debian.org/security/2022/dsa-5099
Third Party Advisory
https://bugs.tryton.org/issue11219
Exploit
Issue Tracking
Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2022/dsa-5098
Third Party Advisory
https://www.debian.org/security/2022/dsa-5099
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.12 (исключая)

cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.5 (исключая)

cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*

Версия от 6.2.0 (включая) до 6.2.2 (исключая)

cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.46 (исключая)

cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.16 (исключая)

cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*

Версия от 6.2.0 (включая) до 6.2.6 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00484

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

CVE-2022-26661

CVSS3: 6.5

ubuntu

почти 4 года назад

CVE-2022-26661

CVSS3: 6.5

debian

почти 4 года назад

An XXE issue was discovered in Tryton Application Platform (Server) 5. ...

GHSA-cj78-rgw3-4h5p

CVSS3: 6.5

github

почти 4 года назад

Improper Restriction of XML External Entity Reference in trytond and proteus

EPSS

Процентиль: 65%

0.00484

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-611