CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26661.json",
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.x"
                },
                {
                    "fixed": "5.0.45"
                },
                {
                    "introduced": "6.x"
                },
                {
                    "fixed": "6.0.15"
                },
                {
                    "introduced": "6.2.x"
                },
                {
                    "fixed": "6.2.5"
                },
                {
                    "introduced": "5.x"
                },
                {
                    "fixed": "5.0.11"
                },
                {
                    "introduced": "6.x"
                },
                {
                    "fixed": "6.0.4"
                },
                {
                    "introduced": "6.2.x"
                },
                {
                    "fixed": "6.2.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/tryton/trytond

Affected ranges

Type

GIT

Repo

https://github.com/tryton/trytond

Events

Introduced

49399603b2eb8d9516df84e3a3855c885fcf9fc5

Fixed

0b39f8e629658f8276a1ee9a4aebd5cd85dd8805

Fixed

93f4d3a4dcda9e3a26bc492d0b40344d4d7ed505

Introduced

b68fa47ada63616d6d0d37118a9417d72d62468d

Fixed

6d8d5ae0745f54e1775e710347c36576699dbd02

Fixed

3f5f1a0931033d11f6ca20513eadcd337bd42b51

Introduced

49721b4fecac6b47dd833ec59e0f4d7bcc1f99d5

Fixed

5ae4e1f9d03d63f0bfa4ea535d3398284df97822

Fixed

3a23d651618c8af6b779a47401c6a88e0b518828

Database specific

{
    "cpe": [
        "cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.12"
        },
        {
            "fixed": "5.0.46"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.5"
        },
        {
            "fixed": "6.0.16"
        },
        {
            "introduced": "6.2.0"
        },
        {
            "fixed": "6.2.2"
        },
        {
            "fixed": "6.2.6"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

5.*

5.0.0

5.0.1

5.0.10

5.0.11

5.0.12

5.0.13

5.0.14

5.0.15

5.0.16

5.0.17

5.0.18

5.0.19

5.0.2

5.0.20

5.0.21

5.0.22

5.0.23

5.0.24

5.0.25

5.0.26

5.0.27

5.0.28

5.0.29

5.0.3

5.0.30

5.0.31

5.0.32

5.0.33

5.0.34

5.0.35

5.0.36

5.0.37

5.0.38

5.0.39

5.0.4

5.0.40

5.0.41

5.0.42

5.0.43

5.0.44

5.0.45

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

6.*

6.0.0

6.0.1

6.0.10

6.0.11

6.0.12

6.0.13

6.0.14

6.0.15

6.0.2

6.0.3

6.0.4

6.0.5

6.0.6

6.0.7

6.0.8

6.0.9

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-26661.json"