VIR Vulnerability Intelligence Relay

CVE-2022-26661

unknown
Published 2022-03-11 · Modified 2024-11-21
CVSS v3
—
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2
—
VIR risk
—

Description

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

Predictions

Exploit likelihood
30%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2022-26661

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed6.0.5-1
debian debianbullseyefixed5.0.8-1+deb11u1
debian debianforkyfixed6.0.5-1
debian debiansidfixed6.0.5-1
debian debiantrixiefixed6.0.5-1

Package impact
EcosystemPackageVulnerableFixed
python PyPItrytond>=5.0.0,<5.0.465.0.46
python PyPItrytond>=6.0.0,<6.0.166.0.16
python PyPItrytond>=6.1.0,<6.2.66.2.6
python PyPIproteus>=5.0.0,<5.0.125.0.12
python PyPIproteus>=6.0.0,<6.0.56.0.5
python PyPIproteus>=6.1.0,<6.2.26.2.2
python PyPItryton>=6.2.0,<5.0.465.0.12

References

Verify integrity in audit chain (admin only). AS-IS.