PT-2012-2406 · Tryton · Tryton

Published 2012-07-12 · Updated 2022-05-04 · CVE-2012-0215

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions trytond versions prior to 2.4.0

Description The issue concerns improper access restriction to the Many2Many field in the relation model. This allows remote authenticated users to modify the privileges of arbitrary users via specific rpc calls, including create, write, delete, or copy operations.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-264

Related Identifiers

CVE-2012-0215

DSA-2444-1

GHSA-CQG4-RF29-3MV6

PYSEC-2012-6

Affected Products

Tryton

References · 14

• 🔥 http://hg.tryton.org/trytond/rev/8e64d52ecea4 · Exploit
• https://osv.dev/vulnerability/GHSA-cqg4-rf29-3mv6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0215 · Security Note
• http://debian.org/security/2012/dsa-2444 · Vendor Advisory
• http://news.tryton.org/2012/03/security-releases-for-all-supported.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0215 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0215 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-0215 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2012-6.yaml · Note
• https://github.com/tryton/trytond · Note
• https://github.com/tryton/trytond/commit/d059ebb792401ded3129cd9402d7392dc34b81e3 · Note
• https://bugs.tryton.org/issue2476 · Note
• https://web.archive.org/web/20121113201043/http://news.tryton.org/2012/03/security-releases-for-all-supported.html · Note