GitHub Advisoryadvisory · PyPI

GHSA-f6f2-pwrj-64h3 Tryton Improper Access Control

HIGH Published 2019-04-10 Modified 2024-11-18 Official page ↗
Aliases
CVE-2019-10868
Ecosystem
PyPI
Packages
trytond
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862
Reviewed
2020-06-16

Affected packages

• PyPI trytond: >= 4.2.0, < 4.2.21 → fixed in 4.2.21 • PyPI trytond: >= 4.4.0, < 4.4.19 → fixed in 4.4.19 • PyPI trytond: >= 4.6.0, < 4.6.14 → fixed in 4.6.14 • PyPI trytond: >= 4.8.0, < 4.8.10 → fixed in 4.8.10 • PyPI trytond: >= 5.0.0, < 5.0.6 → fixed in 5.0.6

Description

In `trytond/model/modelstorage.py` in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.

Related

Alias · CVE (1)

  • CVE-2019-10868 In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References