CVE-2022-26661: XEE

Q: What is the vulnerability ID for this XXE issue?

The vulnerability ID for this XXE issue is CVE-2022-26661.

Q: What is the severity of CVE-2022-26661?

The severity of CVE-2022-26661 is medium with a CVSS score of 6.5.

Q: Which software versions are affected by CVE-2022-26661?

The affected versions of Tryton Application Platform (Server) are 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5. The affected versions of Tryton Application Platform (Command Line Client (proteus)) are 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1.

Q: How can I fix CVE-2022-26661?

To fix CVE-2022-26661, update Tryton Application Platform (Server) to version 5.0.46 or above, 6.0.16 or above, or 6.2.6 or above. Update Tryton Application Platform (Command Line Client (proteus)) to version 5.0.12 or above, 6.0.5 or above, or 6.2.2 or above.

Q: Where can I find more information about CVE-2022-26661?

You can find more information about CVE-2022-26661 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-26661), [Tryton Discussion](https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059), [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html).

Published Mar 7, 2022

Updated

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

Affected Software

23 affected componentsFixes available

pip/proteus>=6.1.0<6.2.2

6.2.2

pip/proteus>=6.0.0<6.0.5

6.0.5

pip/proteus>=5.0.0<5.0.12

5.0.12

pip/trytond>=6.1.0<6.2.6

6.2.6

pip/trytond>=6.0.0<6.0.16

6.0.16

pip/trytond>=5.0.0<5.0.46

5.0.46

tryton proteus>=5.0.0<5.0.12

tryton proteus>=6.0.0<6.0.5

tryton proteus>=6.2.0<6.2.2

tryton trytond>=5.0.0<5.0.46

tryton trytond>=6.0.0<6.0.16

tryton trytond>=6.2.0<6.2.6

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

debian/tryton-proteus<6.0.5-1

6.0.5-1

debian/tryton-proteus<6.0.5-1

6.0.5-1

debian/tryton-proteus<6.0.5-1

6.0.5-1

debian/tryton-server<6.0.16-1

6.0.16-1

debian/tryton-server<6.0.16-1

6.0.16-1

debian/tryton-server<6.0.16-1

6.0.16-1

debian/tryton-proteus

6.0.8-17.0.1-37.0.3-1

debian/tryton-server

6.0.29-2+deb12u47.0.30-1+deb13u27.0.56-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/proteus to a version that resolves this vulnerability.
Fixed in 6.2.2
Upgrade
Upgrade pip/proteus to a version that resolves this vulnerability.
Fixed in 6.0.5
Upgrade
Upgrade pip/proteus to a version that resolves this vulnerability.
Fixed in 5.0.12
Upgrade
Upgrade pip/trytond to a version that resolves this vulnerability.
Fixed in 6.2.6
Upgrade
Upgrade pip/trytond to a version that resolves this vulnerability.
Fixed in 6.0.16
Upgrade
Upgrade pip/trytond to a version that resolves this vulnerability.
Fixed in 5.0.46
Upgrade
Upgrade debian/tryton-proteus to a version that resolves this vulnerability.
Fixed in 6.0.8-1Fixed in 7.0.1-3Fixed in 7.0.3-1
Upgrade
Upgrade debian/tryton-server to a version that resolves this vulnerability.
Fixed in 6.0.29-2+deb12u4Fixed in 7.0.30-1+deb13u2Fixed in 7.0.56-1
Upgrade
Upgrade debian/tryton-proteus to a version that resolves this vulnerability.
Fixed in 6.0.5-1
Upgrade
Upgrade debian/tryton-server to a version that resolves this vulnerability.
Fixed in 6.0.16-1

Event History

Mar 7, 2022

CVE Published

via MITRE·10:40 PM

Data Sourced

via MITRE·10:40 PM

Description

Mar 10, 2022

Data Sourced

via OSV·05:47 PM

DescriptionSeverityAffected Software

Mar 11, 2022

Advisory Published

12:02 AM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this XXE issue?

The vulnerability ID for this XXE issue is CVE-2022-26661.

What is the severity of CVE-2022-26661?

The severity of CVE-2022-26661 is medium with a CVSS score of 6.5.

Which software versions are affected by CVE-2022-26661?

The affected versions of Tryton Application Platform (Server) are 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5. The affected versions of Tryton Application Platform (Command Line Client (proteus)) are 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1.

How can I fix CVE-2022-26661?

To fix CVE-2022-26661, update Tryton Application Platform (Server) to version 5.0.46 or above, 6.0.16 or above, or 6.2.6 or above. Update Tryton Application Platform (Command Line Client (proteus)) to version 5.0.12 or above, 6.0.5 or above, or 6.2.2 or above.

Where can I find more information about CVE-2022-26661?

You can find more information about CVE-2022-26661 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-26661), [Tryton Discussion](https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059), [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html).

CVE-2022-26661: XEE

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID for this XXE issue?

What is the severity of CVE-2022-26661?

Which software versions are affected by CVE-2022-26661?

How can I fix CVE-2022-26661?

Where can I find more information about CVE-2022-26661?

Company

Resources

Contact