PT-2019-20144 · Tryton · Tryton

Publicado 2019-04-05 · Atualizado 2019-04-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Tryton versions 4.2 through 4.2.20 Tryton versions 4.4 through 4.4.18 Tryton versions 4.6 through 4.6.13 Tryton versions 4.8 through 4.8.9 Tryton versions 5.0 through 5.0.5

Description The issue allows an authenticated user to order records based on a field for which they have no access right, potentially enabling them to guess values.

Recommendations For Tryton versions 4.2 through 4.2.20, update to version 4.2.21 or later. For Tryton versions 4.4 through 4.4.18, update to version 4.4.19 or later. For Tryton versions 4.6 through 4.6.13, update to version 4.6.14 or later. For Tryton versions 4.8 through 4.8.9, update to version 4.8.10 or later. For Tryton versions 5.0 through 5.0.5, update to version 5.0.6 or later.

Identificadores relacionados

PYSEC-2019-57

Produtos afetados

Tryton

Referências · 5

• https://discuss.tryton.org/t/security-release-for-issue8189/1262 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-57 · Aviso do Fabricante
• https://hg.tryton.org/trytond/rev/f58bbfe0aefb · Nota
• https://debian.org/security/2019/dsa-4426 · Aviso do Fabricante
• https://seclists.org/bugtraq/2019/Apr/14 · Nota