Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-26662
HistoryMar 10, 2022 - 12:00 a.m.

CVE-2022-26662

2022-03-1000:00:00
ubuntu.com
ubuntu.com
23
xml entity expansion
tryton application platform
unauthenticated user
server resources
xml-rpc message
unix

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.006

Percentile

79.1%

An XML Entity Expansion (XEE) issue was discovered in Tryton Application
Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and
6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client
(proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x
through 6.2.1. An unauthenticated user can send a crafted XML-RPC message
to consume all the resources of the server.

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.006

Percentile

79.1%