PT-2012-2406 · Tryton · Tryton

Publicado 2012-07-12 · Atualizado 2022-05-04 · CVE-2012-0215

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions trytond versions prior to 2.4.0

Description The issue concerns improper access restriction to the Many2Many field in the relation model. This allows remote authenticated users to modify the privileges of arbitrary users via specific rpc calls, including create, write, delete, or copy operations.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-264

Identificadores relacionados

CVE-2012-0215

DSA-2444-1

GHSA-CQG4-RF29-3MV6

PYSEC-2012-6

Produtos afetados

Tryton

Referências · 14

• 🔥 http://hg.tryton.org/trytond/rev/8e64d52ecea4 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2012-6.yaml · Nota
• https://github.com/tryton/trytond · Nota
• https://github.com/tryton/trytond/commit/d059ebb792401ded3129cd9402d7392dc34b81e3 · Nota
• https://bugs.tryton.org/issue2476 · Nota
• https://osv.dev/vulnerability/GHSA-cqg4-rf29-3mv6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-0215 · Nota de Segurança
• http://debian.org/security/2012/dsa-2444 · Aviso do Fabricante
• https://web.archive.org/web/20121113201043/http://news.tryton.org/2012/03/security-releases-for-all-supported.html · Nota
• http://news.tryton.org/2012/03/security-releases-for-all-supported.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-0215 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2012-6 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0215 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-0215 · Aviso do Fabricante