PT-2017-10548 · Tryton · Tryton

Published 2017-04-04 · Updated 2022-05-13 · CVE-2017-0360

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tryton versions 3.x through 4.2.2

Description The issue allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. This is due to an incomplete fix for a previous issue.

Recommendations For Tryton versions 3.x through 4.2.2, consider restricting file access permissions to minimize the risk of exploitation until a complete fix is available. As a temporary workaround, limit the ability of authenticated users to read files using the file open function.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-0360

DLA-882-1

DSA-3826-1

GHSA-7CWG-2575-3546

PYSEC-2017-97

Affected Products

Tryton

References · 19

• https://security-tracker.debian.org/tracker/CVE-2017-0360 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-0360 · Security Note
• https://osv.dev/vulnerability/GHSA-7cwg-2575-3546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0360 · Security Note
• https://ubuntu.com/security/CVE-2017-0360 · Vendor Advisory
• http://debian.org/security/2017/dsa-3826 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0360 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-0360 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-0360 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-97 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3826-1 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2017-97.yaml · Note
• https://github.com/tryton/trytond · Note
• https://github.com/tryton/trytond/commit/30e978593733385db3144f8c583eeb4679575cf0 · Note
• https://github.com/tryton/trytond/commit/a67a7f03c30277515f530cad5950056171ed5bd1 · Note