CVE-2014-6633: Command Injection
The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the pricelist module.
Other sources
The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the pricelist module.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6633?
The severity of CVE-2014-6633 is critical with a score of 8.8.
How does CVE-2014-6633 affect Tryton?
CVE-2014-6633 affects Tryton versions before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3.
What can remote authenticated users do with CVE-2014-6633?
Remote authenticated users can execute arbitrary commands via shell metacharacters in the collection.domain in the webdav module or the formula.
How can I fix CVE-2014-6633 in Tryton?
To fix CVE-2014-6633 in Tryton, you should update to version 2.4.15, 2.6.14, 2.8.11, 3.0.7, or 3.2.3.
Where can I find more information about CVE-2014-6633?
You can find more information about CVE-2014-6633 at the following references: http://www.tryton.org/posts/security-release-for-issue4155.html and https://bugs.tryton.org/issue4155.