PT-2019-20144 · Tryton · Tryton

Published 2019-04-05 · Updated 2019-04-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Tryton versions 4.2 through 4.2.20 Tryton versions 4.4 through 4.4.18 Tryton versions 4.6 through 4.6.13 Tryton versions 4.8 through 4.8.9 Tryton versions 5.0 through 5.0.5

Description The issue allows an authenticated user to order records based on a field for which they have no access right, potentially enabling them to guess values.

Recommendations For Tryton versions 4.2 through 4.2.20, update to version 4.2.21 or later. For Tryton versions 4.4 through 4.4.18, update to version 4.4.19 or later. For Tryton versions 4.6 through 4.6.13, update to version 4.6.14 or later. For Tryton versions 4.8 through 4.8.9, update to version 4.8.10 or later. For Tryton versions 5.0 through 5.0.5, update to version 5.0.6 or later.

Related Identifiers

PYSEC-2019-57

Affected Products

Tryton

References · 5

• https://osv.dev/vulnerability/PYSEC-2019-57 · Vendor Advisory
• https://debian.org/security/2019/dsa-4426 · Vendor Advisory
• https://discuss.tryton.org/t/security-release-for-issue8189/1262 · Note
• https://hg.tryton.org/trytond/rev/f58bbfe0aefb · Note
• https://seclists.org/bugtraq/2019/Apr/14 · Note