PyPI: trytond
CVE-2012-0215
Safety vulnerability ID: SFTY-20120712-26274
Safety legacy ID: pyup.io-26166
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Overview
Trytond allows modification of privileges of arbitrary users
Advisory
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20120712-26274/CVE-2012-0215
- https://nvd.nist.gov/vuln/detail/CVE-2012-0215
- https://bugs.tryton.org/issue2476
- http://hg.tryton.org/trytond/rev/8e64d52ecea4
- http://www.debian.org/security/2012/dsa-2444
- https://github.com/tryton/trytond/commit/d059ebb792401ded3129cd9402d7392dc34b81e3
- https://web.archive.org/web/20121113201043/http://news.tryton.org/2012/03/security-releases-for-all-supported.html
- https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2012-6.yaml
- http://news.tryton.org/2012/03/security-releases-for-all-supported.html
- https://github.com/advisories/GHSA-cqg4-rf29-3mv6
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more