What is CVE-2014-6633?

CVE-2014-6633 is a high-severity vulnerability in Tryton, classified under Command Injection. CVSS score: 8.8/10. Published 2018-04-12.

How severe is CVE-2014-6633?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Tryton

CVE-2014-6633

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.026 (83.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tryton
N/a — versions n/a

Weakness classification (CWE)

CWE-77 — Command Injection

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Issue Tracking)

Frequently asked questions

What is CVE-2014-6633?: CVE-2014-6633 is a high-severity vulnerability in Tryton, classified under Command Injection. CVSS score: 8.8/10. Published 2018-04-12.
How severe is CVE-2014-6633?: High severity. CVSS v3 base score is 8.8 out of 10.