CVEvulnerability
CVE-2012-0215
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-07-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
- Weaknesses
- CWE-264
Description
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Affected configurations
• tryton trytond (<= 2.2.3)
• tryton trytond 1.4.13
• tryton trytond 1.6.8
• tryton trytond 1.8.7
• tryton trytond 2.0.5
Related
Weakness · not in database (1)
References
- http://hg.tryton.org/trytond/rev/8e64d52ecea4 Exploit, Patch
- http://news.tryton.org/2012/03/security-releases-for-all-supported.html Vendor Advisory
- http://www.debian.org/security/2012/dsa-2444 www.debian.org
- https://bugs.tryton.org/issue2476 bugs.tryton.org
- http://hg.tryton.org/trytond/rev/8e64d52ecea4 Exploit, Patch
- http://news.tryton.org/2012/03/security-releases-for-all-supported.html Vendor Advisory
- http://www.debian.org/security/2012/dsa-2444 www.debian.org
- https://bugs.tryton.org/issue2476 bugs.tryton.org