NetSight
IP …
high7.5

CVE-2022-26662

XML Entity Expansion in trytond and proteus

Impact

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

Affected packages

EcosystemPackageAffectedFixed in
piptrytond>= 5.0.0, < 5.0.465.0.46
pipproteus>= 5.0.0, < 5.0.125.0.12

Affected products

VendorProductAffected versions
TrytonProteus
from 5.0.0 before 5.0.12
from 6.0.0 before 6.0.5
from 6.2.0 before 6.2.2
TrytonTrytond
from 5.0.0 before 5.0.46
from 6.0.0 before 6.0.16
from 6.2.0 before 6.2.6
DebianDebian Linux
Versions 9.0, 10.0, 11.0

Weakness classification

CWE-776

References