CVE-2022-26662

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-26662
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-26662.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-26662
Aliases
Downstream
Published
2022-03-10T17:47:52.560Z
Modified
2026-02-03T08:03:11.698544Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

References

Affected packages

Git / github.com/tryton/trytond

Affected ranges

Type
GIT
Repo
https://github.com/tryton/trytond
Events
Introduced
49399603b2eb8d9516df84e3a3855c885fcf9fc5
Fixed
0b39f8e629658f8276a1ee9a4aebd5cd85dd8805
Introduced
49721b4fecac6b47dd833ec59e0f4d7bcc1f99d5
Fixed
5ae4e1f9d03d63f0bfa4ea535d3398284df97822
Introduced
b68fa47ada63616d6d0d37118a9417d72d62468d
Fixed
6d8d5ae0745f54e1775e710347c36576699dbd02

Affected versions

5.*
5.0.0
5.0.1
5.0.10
5.0.11
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.2.0
5.4.0
5.6.0
5.8.0
6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.2.0
6.2.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-26662.json"