CVE-2022-26662

Опубликовано: 10 мар. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

Ссылки

https://bugs.tryton.org/issue11244
Patch
Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2022/dsa-5098
Third Party Advisory
https://www.debian.org/security/2022/dsa-5099
Third Party Advisory
https://bugs.tryton.org/issue11244
Patch
Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2022/dsa-5098
Third Party Advisory
https://www.debian.org/security/2022/dsa-5099
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.12 (исключая)

cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.5 (исключая)

cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*

Версия от 6.2.0 (включая) до 6.2.2 (исключая)

cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.46 (исключая)

cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.16 (исключая)

cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*

Версия от 6.2.0 (включая) до 6.2.6 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05585

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-776

Связанные уязвимости

CVE-2022-26662

CVSS3: 7.5

ubuntu

почти 4 года назад

CVE-2022-26662

CVSS3: 7.5

debian

почти 4 года назад

An XML Entity Expansion (XEE) issue was discovered in Tryton Applicati ...

GHSA-pm3h-mm62-pwm8

CVSS3: 7.5

github

почти 4 года назад

XML Entity Expansion in trytond and proteus

EPSS

Процентиль: 90%

0.05585

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-776