CVE-2014-6633

Description

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

1.034

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond 2.4.15	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond 2.6.14	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond 2.8.11	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond 3.0.7	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond 3.2.3	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton 2.4.15	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton 2.6.14	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton 2.8.11	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton 3.2.3	Windows
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond for linux 2.4.15	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond for linux 2.6.14	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond for linux 2.8.11	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond for linux 3.0.7	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-trytond for linux 3.2.3	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton for linux 2.4.15	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton for linux 2.6.14	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton for linux 2.8.11	Linux
Vulnerabilities CVE-2014-6633 are fixed in Python-tryton for linux 3.2.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234