Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-te21-ks2b-dfhy

Summary An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

Aliases

alias	CVE-2022-26661

alias	GHSA-cj78-rgw3-4h5p

alias	PYSEC-2022-43170

Fixed_packages

url	pkg:pypi/proteus@5.0.12
purl	pkg:pypi/proteus@5.0.12
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@5.0.12

url	pkg:pypi/proteus@6.0.5
purl	pkg:pypi/proteus@6.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.0.5

url	pkg:pypi/proteus@6.2.2
purl	pkg:pypi/proteus@6.2.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.2.2

url	pkg:pypi/tryton@5.0.12
purl	pkg:pypi/tryton@5.0.12
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.12

url	pkg:pypi/tryton@5.0.46
purl	pkg:pypi/tryton@5.0.46
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.46

url	pkg:pypi/tryton@6.0.5
purl	pkg:pypi/tryton@6.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.5

url	pkg:pypi/tryton@6.0.16
purl	pkg:pypi/tryton@6.0.16
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.16

url	pkg:pypi/tryton@6.2.2
purl	pkg:pypi/tryton@6.2.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.2

url	pkg:pypi/tryton@6.2.6
purl	pkg:pypi/tryton@6.2.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.6

url	pkg:pypi/trytond@5.0.46
purl	pkg:pypi/trytond@5.0.46
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@5.0.46

url	pkg:pypi/trytond@6.0.16
purl	pkg:pypi/trytond@6.0.16
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.0.16

url	pkg:pypi/trytond@6.2.6
purl	pkg:pypi/trytond@6.2.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.2.6

Affected_packages

url pkg:pypi/proteus@5.0.0

purl pkg:pypi/proteus@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@5.0.0

url pkg:pypi/proteus@6.0.0

purl pkg:pypi/proteus@6.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.0.0

url pkg:pypi/proteus@6.1.0

purl pkg:pypi/proteus@6.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.1.0

url pkg:pypi/tryton@5.0.0

purl pkg:pypi/tryton@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-b7zr-zrzn-w3ej

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.0

url pkg:pypi/tryton@5.0.1

purl pkg:pypi/tryton@5.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.1

url pkg:pypi/tryton@5.0.2

purl pkg:pypi/tryton@5.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.2

url pkg:pypi/tryton@5.0.3

purl pkg:pypi/tryton@5.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.3

url pkg:pypi/tryton@5.0.4

purl pkg:pypi/tryton@5.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.4

url pkg:pypi/tryton@5.0.5

purl pkg:pypi/tryton@5.0.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.5

url pkg:pypi/tryton@5.0.6

purl pkg:pypi/tryton@5.0.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.6

url pkg:pypi/tryton@5.0.7

purl pkg:pypi/tryton@5.0.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.7

url pkg:pypi/tryton@5.0.8

purl pkg:pypi/tryton@5.0.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.8

url pkg:pypi/tryton@5.0.9

purl pkg:pypi/tryton@5.0.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.9

url pkg:pypi/tryton@5.0.10

purl pkg:pypi/tryton@5.0.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.10

url pkg:pypi/tryton@5.0.11

purl pkg:pypi/tryton@5.0.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.11

url pkg:pypi/tryton@6.0.0

purl pkg:pypi/tryton@6.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.0

url pkg:pypi/tryton@6.0.1

purl pkg:pypi/tryton@6.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.1

url pkg:pypi/tryton@6.0.2

purl pkg:pypi/tryton@6.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.2

url pkg:pypi/tryton@6.0.3

purl pkg:pypi/tryton@6.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.3

url pkg:pypi/tryton@6.0.4

purl pkg:pypi/tryton@6.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.4

url pkg:pypi/tryton@6.2.0

purl pkg:pypi/tryton@6.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.0

url pkg:pypi/tryton@6.2.1

purl pkg:pypi/tryton@6.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.1

url pkg:pypi/trytond@6.0.0

purl pkg:pypi/trytond@6.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-7y7d-usj9-4bc4

vulnerability	VCID-aa7x-ejc8-7bfz

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.0.0

url pkg:pypi/trytond@6.2.0

purl pkg:pypi/trytond@6.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.2.0

url pkg:pypi/trytond@5.0.0

purl pkg:pypi/trytond@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-kjnf-nmzs-c7b5

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@5.0.0

References

reference_url

https://bugs.tryton.org/issue11219

reference_id

reference_type

scores

value	6.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

url

https://bugs.tryton.org/issue11219

reference_url

https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059

reference_id

reference_type

scores

value	6.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

url

https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059

reference_url

https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html

reference_id

reference_type

scores

value	6.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

url

https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html

reference_url

https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html

reference_id

reference_type

scores

value	6.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

url

https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html

reference_url

https://www.debian.org/security/2022/dsa-5098

reference_id

reference_type

scores

value	6.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

url

https://www.debian.org/security/2022/dsa-5098

reference_url

https://www.debian.org/security/2022/dsa-5099

reference_id

reference_type

scores

value	6.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

url

https://www.debian.org/security/2022/dsa-5099

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2022-26661
reference_id	CVE-2022-26661
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2022-26661

reference_url	https://github.com/advisories/GHSA-cj78-rgw3-4h5p
reference_id	GHSA-cj78-rgw3-4h5p
reference_type
scores
url	https://github.com/advisories/GHSA-cj78-rgw3-4h5p

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	611
name	Improper Restriction of XML External Entity Reference
description	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score 6.5 - 6.5

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-te21-ks2b-dfhy

Vulnerability Instance