Lucene search

K

GoogleOSV:GHSA-CQG4-RF29-3MV6

HistoryMay 04, 2022 - 12:28 a.m.

Trytond allows modification of privileges of arbitrary users

2022-05-0400:28:50

Google

osv.dev

5

6.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

75.2%

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.

CPENameOperatorVersion
trytondeq2.2.6
trytondeq1.8.6
trytondeq1.4.7
trytondeq2.0.2
trytondeq1.4.6
trytondeq2.0.3
trytondeq1.4.1
trytondeq2.2.8
trytondeq1.0.6
trytondeq2.0.11

Rows per page:

1-10 of 871

References

hg.tryton.org/trytond/rev/8e64d52ecea4

www.debian.org/security/2012/dsa-2444

bugs.tryton.org/issue2476

github.com/tryton/trytond

github.com/tryton/trytond/commit/d059ebb792401ded3129cd9402d7392dc34b81e3

nvd.nist.gov/vuln/detail/CVE-2012-0215

web.archive.org/web/20121113201043/news.tryton.org/2012/03/security-releases-for-all-supported.html

6.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

75.2%

Related for OSV:GHSA-CQG4-RF29-3MV6

nessus4 openvas8 ubuntucve1 osv1 prion1 nvd1 fedora3 debiancve1 cvelist1 securityvulns2 debian1 github1 cve1 seebug1