GitHub Advisoryadvisory · PyPI

GHSA-jpr7-8rxm-4vgx Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter

MEDIUM Published 2022-05-17 Modified 2024-11-22 Official page ↗
Aliases
CVE-2016-1242
Ecosystem
PyPI
Packages
trytond
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-29

Affected packages

• PyPI trytond: < 3.2.17 → fixed in 3.2.17 • PyPI trytond: >= 3.4, < 3.4.14 → fixed in 3.4.14 • PyPI trytond: >= 3.6, < 3.6.12 → fixed in 3.6.12 • PyPI trytond: >= 3.8, < 3.8.8 → fixed in 3.8.8 • PyPI trytond: >= 4.0, < 4.0.4 → fixed in 4.0.4

Description

`file_open` in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.

Related

Alias · CVE (1)

  • CVE-2016-1242 file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References