Vulnerability Database

296,213

Total vulnerabilities in the database

CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Low
  • Score: 4
  • AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
tryton / proteus 5.0.0 5.0.12
tryton / proteus 6.0.0 6.0.5
tryton / proteus 6.2.0 6.2.2
tryton / trytond 6.2.0 6.2.6
tryton / trytond 6.0.0 6.0.16
tryton / trytond 5.0.0 5.0.46
debian / debian_linux 9.0 9.0.x
debian / debian_linux 10.0 10.0.x
debian / debian_linux 11.0 11.0.x
Python icon trytond 5.0.0 5.0.46
Python icon trytond 6.0.0 6.0.16
Python icon trytond 6.1.0 6.2.6
Python icon proteus 5.0.0 5.0.12
Python icon proteus 6.0.0 6.0.5
Python icon proteus 6.1.0 6.2.2