XXE in Tryton Proteus
CVE-2022-26662
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.020 (79.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 79.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.020 · newest: 0.020 · change: 0.000
Affected products
- Tryton Proteus
- Tryton Trytond
- Debian Linux — versions 9.0, 10.0, 11.0
Weakness classification (CWE)
References
- discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059 (Vendor Advisory)
- bugs.tryton.org/issue11244 (Patch, Vendor Advisory)
- lists.debian.org/debian-lts-announce/2022/03/msg00016.html (mailing-list, Mailing List, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2022/03/msg00017.html (mailing-list, Mailing List, Third Party Advisory)
- www.debian.org/security/2022/dsa-5098 (vendor-advisory, Third Party Advisory)
- www.debian.org/security/2022/dsa-5099 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-26662?
- CVE-2022-26662 is a high-severity vulnerability in Tryton Proteus, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 7.5/10. Published 2022-03-10.
- How severe is CVE-2022-26662?
- High severity. CVSS v3 base score is 7.5 out of 10.