GitHub Advisoryadvisory · PyPI

GHSA-cqg4-rf29-3mv6 Trytond allows modification of privileges of arbitrary users

HIGH Published 2022-05-04 Modified 2024-11-18 Official page ↗
Aliases
CVE-2012-0215
Ecosystem
PyPI
Packages
trytond
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287
Reviewed
2024-01-12

Affected packages

• PyPI trytond: < 2.4.0 → fixed in 2.4.0

Description

`model/modelstorage.py` in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.

Related

Alias · CVE (1)

  • CVE-2012-0215 model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References