CVE-2020-37014
Publication date 2 February 2026
Last updated 2 February 2026
Ubuntu priority
Description
Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| tryton-sao | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy | Not in release |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.4 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2020-37014
- https://www.exploit-db.com/exploits/48466
- https://www.vulnerability-lab.com/get_content.php?id=2233
- https://foss.heptapod.net/tryton/tryton/-/issues/9351
- https://www.tryton.org/
- https://www.tryton.org/download
- https://www.vulncheck.com/advisories/tryton-persistent-cross-site-scripting