CVE-2022-26662

Description

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

How to fix CVE-2022-26662

To remediate CVE-2022-26662, upgrade the affected package to a fixed version below.

• —upgrade to 5.0.12 or later
• —upgrade to 5.0.12 or later
• —upgrade to 5.0.12 or later
• —upgrade to 5.0.46 or later
• —upgrade to 5.0.46 or later

Is CVE-2022-26662 being exploited?

Low — EPSS is 1.9%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• >= 5.0.0, < 5.0.12
• >= 5.0.0, < 5.0.12, >= 6.0.0, < 6.0.5, >= 6.1.0, < 6.2.2
• >= 5.0.0, < 5.0.12, >= 6.0.0, < 6.0.5, >= 6.2.0, < 6.2.2, < 6.2.6, < 6.0.16, < 5.0.46
• >= 5.0.0, < 5.0.46
• >= 5.0.0, < 5.0.46, >= 6.0.0, < 6.0.16, >= 6.1.0, < 6.2.6

CVSS scores

References (11)

• ADVISORYgithub.com/advisories/GHSA-pm3h-mm62-pwm8
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-26662
• PATCHhg.tryton.org/trytond
• PATCHpypi.org/project/proteus
• PATCHpypi.org/project/trytond