VulnerabilityModified

CVE-2022-26662

HIGH 7.5EPSS 1.97%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.97%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 1.97% probability · 79th percentile
CISA KEV: Not listed
Weakness: CWE-776
Affected: tryton/proteus · tryton/trytond · debian/debian linux
Source: cve@mitre.org

References

https://bugs.tryton.org/issue11244Patch, Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5098Third Party Advisory
https://www.debian.org/security/2022/dsa-5099Third Party Advisory
https://bugs.tryton.org/issue11244Patch, Vendor Advisory
https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00016.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00017.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5098Third Party Advisory
https://www.debian.org/security/2022/dsa-5099Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.