GitHub Advisoryadvisory · PyPI

GHSA-7cwg-2575-3546 Tryton Information Disclosure Vulnerability

MEDIUM Published 2022-05-13 Modified 2024-11-18 Official page ↗
Aliases
CVE-2017-0360
Ecosystem
PyPI
Packages
trytond
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-269
Reviewed
2024-04-22

Affected packages

• PyPI trytond: >= 3.0.0, <= 3.0.17 (no fix yet) • PyPI trytond: >= 3.2.0, <= 3.2.17 (no fix yet) • PyPI trytond: >= 3.4.0, <= 3.4.17 (no fix yet) • PyPI trytond: >= 3.6.0, <= 3.6.16 (no fix yet) • PyPI trytond: >= 3.8.0, <= 3.8.14 (no fix yet) • PyPI trytond: >= 4.0.0, <= 4.0.9 (no fix yet) • PyPI trytond: >= 4.2.0, < 4.2.3 → fixed in 4.2.3

Description

file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.

Related

Alias · CVE (1)

  • CVE-2017-0360 file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References