{"api_version":"1","generated_at":"2026-07-23T14:37:55+00:00","cve":"CVE-2022-26662","urls":{"html":"https://cve.report/CVE-2022-26662","api":"https://cve.report/api/cve/CVE-2022-26662.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-26662","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-26662"},"summary":{"title":"CVE-2022-26662","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-03-10 17:47:00","updated_at":"2022-03-18 15:07:00"},"problem_types":["CWE-776"],"metrics":[],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html","name":"[debian-lts-announce] 20220311 [SECURITY] [DLA 2946-1] tryton-proteus security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2946-1] tryton-proteus security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html","name":"[debian-lts-announce] 20220310 [SECURITY] [DLA 2945-1] tryton-server security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2945-1] tryton-server security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.debian.org/security/2022/dsa-5098","name":"DSA-5098","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5098-1 tryton-server","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","name":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","refsource":"MISC","tags":[],"title":"Security Release for issue11219 and issue11244 - News - Tryton Discussion","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugs.tryton.org/issue11244","name":"https://bugs.tryton.org/issue11244","refsource":"MISC","tags":[],"title":"Issue 11244: A non authenticated user can cause a denial of service with a single request using an xml bomb attack on xmlrpc - Tryton issue tracker","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.debian.org/security/2022/dsa-5099","name":"DSA-5099","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5099-1 tryton-proteus","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26662","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26662","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"26662","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26662","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26662","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26662","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"tryton","cpe5":"proteus","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26662","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"tryton","cpe5":"trytond","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-26662","qid":"179124","title":"Debian Security Update for tryton-server (DLA 2945-1)"},{"cve":"CVE-2022-26662","qid":"179125","title":"Debian Security Update for tryton-proteus (DLA 2946-1)"},{"cve":"CVE-2022-26662","qid":"179141","title":"Debian Security Update for tryton-server (DSA 5098-1)"},{"cve":"CVE-2022-26662","qid":"179147","title":"Debian Security Update for tryton-proteus (DSA 5099-1)"},{"cve":"CVE-2022-26662","qid":"183136","title":"Debian Security Update for tryton-servertryton-proteus (CVE-2022-26662)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2022-26662","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","refsource":"MISC","name":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059"},{"url":"https://bugs.tryton.org/issue11244","refsource":"MISC","name":"https://bugs.tryton.org/issue11244"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220310 [SECURITY] [DLA 2945-1] tryton-server security update","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220311 [SECURITY] [DLA 2946-1] tryton-proteus security update","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html"},{"refsource":"DEBIAN","name":"DSA-5098","url":"https://www.debian.org/security/2022/dsa-5098"},{"refsource":"DEBIAN","name":"DSA-5099","url":"https://www.debian.org/security/2022/dsa-5099"}]}},"nvd":{"publishedDate":"2022-03-10 17:47:00","lastModifiedDate":"2022-03-18 15:07:00","problem_types":["CWE-776"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.12","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.0","versionEndExcluding":"6.2.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.0","versionEndExcluding":"6.2.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.16","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.46","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}