CVE-2012-0215

2022-10-0316:15:38

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-0215

tryton

security

access restriction

unauthorized modification

nvd

python

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

6.2 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

75.2%

JSON

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.

Affected configurations

NVD

Node

trytontrytondRange≤2.2.3

trytontrytondMatch1.4.13

trytontrytondMatch1.6.8

trytontrytondMatch1.8.7

trytontrytondMatch2.0.5

CPENameOperatorVersion
tryton:trytondtryton trytondle2.2.3
tryton:trytondtryton trytondeq1.4.13
tryton:trytondtryton trytondeq1.6.8
tryton:trytondtryton trytondeq1.8.7
tryton:trytondtryton trytondeq2.0.5

CPE	Name	Operator	Version
tryton:trytond	tryton trytond	le	2.2.3
tryton:trytond	tryton trytond	eq	1.4.13
tryton:trytond	tryton trytond	eq	1.6.8
tryton:trytond	tryton trytond	eq	1.8.7
tryton:trytond	tryton trytond	eq	2.0.5