PT-2017-10548 · Tryton · Tryton

Publicado 2017-04-04 · Atualizado 2022-05-13 · CVE-2017-0360

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Média

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tryton versions 3.x through 4.2.2

Description The issue allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. This is due to an incomplete fix for a previous issue.

Recommendations For Tryton versions 3.x through 4.2.2, consider restricting file access permissions to minimize the risk of exploitation until a complete fix is available. As a temporary workaround, limit the ability of authenticated users to read files using the file open function.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2017-0360

DLA-882-1

DSA-3826-1

GHSA-7CWG-2575-3546

PYSEC-2017-97

Produtos afetados

Tryton

Referências · 19

• https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2017-97.yaml · Nota
• https://github.com/tryton/trytond · Nota
• https://github.com/tryton/trytond/commit/30e978593733385db3144f8c583eeb4679575cf0 · Nota
• https://github.com/tryton/trytond/commit/a67a7f03c30277515f530cad5950056171ed5bd1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-0360 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-0360 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-7cwg-2575-3546 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0360 · Nota de Segurança
• http://securityfocus.com/bid/97489 · Nota
• http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8 · Nota
• https://ubuntu.com/security/CVE-2017-0360 · Aviso do Fabricante
• https://lists.debian.org/debian-security-announce/2017/msg00084.html · Nota
• http://debian.org/security/2017/dsa-3826 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0360 · Aviso do Fabricante
• http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8 · Nota