VulnerabilityModified

CVE-2022-26661

MEDIUM 6.5EPSS 1.41%

Does this matter?

Lower severity and a low EPSS score (1.41%). Track it; it rarely justifies an emergency change on its own.

Description

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.41% probability · 71th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: tryton/proteus · tryton/trytond · debian/debian linux
Source: cve@mitre.org

References

https://bugs.tryton.org/issue11219Exploit, Issue Tracking, Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5098Third Party Advisory
https://www.debian.org/security/2022/dsa-5099Third Party Advisory
https://bugs.tryton.org/issue11219Exploit, Issue Tracking, Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5098Third Party Advisory
https://www.debian.org/security/2022/dsa-5099Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.