GitHub Advisoryadvisory · PyPI

GHSA-c8q5-2j73-qvcc trytond arbitrary fields write via a sequence of records

MEDIUM Published 2022-05-14 Modified 2024-11-18 Official page ↗
Aliases
CVE-2015-0861
Ecosystem
PyPI
Packages
trytond
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Reviewed
2024-04-29

Affected packages

• PyPI trytond: >= 3.2.0, < 3.2.10 → fixed in 3.2.10 • PyPI trytond: >= 3.4.0, < 3.4.8 → fixed in 3.4.8 • PyPI trytond: >= 3.6.0, < 3.6.5 → fixed in 3.6.5 • PyPI trytond: >= 3.8.0, < 3.8.1 → fixed in 3.8.1

Description

`model/modelstorage.py` in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.

Related

Alias · CVE (1)

  • CVE-2015-0861 model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote… vulnerability

References