Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2014-6633

Good to know:

icon

Date: April 12, 2018

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Language: Python

Severity Score

Related Resources (8)

https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2018-59.yaml
https://bugs.tryton.org/issue4155
http://www.tryton.org/posts/security-release-for-issue4155.html
https://github.com/tryton/trytond/commit/3e4c2b7e8c7b3358597a0d484fa98f45483ee92a
https://nvd.nist.gov/vuln/detail/CVE-2014-6633
https://github.com/tryton/trytond/commit/19fc2a01357b7638041953326e404f51d96fad06
https://github.com/tryton/trytond
https://www.mend.io/vulnerability-database/CVE-2014-6633

Severity Score

Weakness Type (CWE)

Command Injection

CWE-77

Top Fix

icon

Upgrade Version

Upgrade to version 2014.2.rc1,2014.1.3

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): COMPLETE
Integrity (I): COMPLETE
Availability (A): COMPLETE
Additional information:

Do you need more information?

Contact Us