CVE-2012-0215 Trytond allows modification of privileges of arbitrary users
MediumCVSS 5.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi trytond(PyPI) | < 2.4.0 | 2.4.0 |
| pypi trytond(PyPI) | = 1.0.0 | No fix listed |
| pypi trytond(PyPI) | = 1.0.1 | No fix listed |
| pypi trytond(PyPI) | = 1.0.2 | No fix listed |
| pypi trytond(PyPI) | = 1.0.3 | No fix listed |
| pypi trytond(PyPI) | = 1.0.4 | No fix listed |
| pypi trytond(PyPI) | = 1.0.5 | No fix listed |
| pypi trytond(PyPI) | = 1.0.6 | No fix listed |
| pypi trytond(PyPI) | = 1.0.7 | No fix listed |
| pypi trytond(PyPI) | = 1.0.8 | No fix listed |
| pypi trytond(PyPI) | = 1.0.9 | No fix listed |
| pypi trytond(PyPI) | = 1.2.0 | No fix listed |
| pypi trytond(PyPI) | = 1.2.1 | No fix listed |
| pypi trytond(PyPI) | = 1.2.10 | No fix listed |
| pypi trytond(PyPI) | = 1.2.2 | No fix listed |
| pypi trytond(PyPI) | = 1.2.3 | No fix listed |
| pypi trytond(PyPI) | = 1.2.4 | No fix listed |
| pypi trytond(PyPI) | = 1.2.5 | No fix listed |
| pypi trytond(PyPI) | = 1.2.6 | No fix listed |
| pypi trytond(PyPI) | = 1.2.7 | No fix listed |
| pypi trytond(PyPI) | = 1.2.8 | No fix listed |
| pypi trytond(PyPI) | = 1.2.9 | No fix listed |
| pypi trytond(PyPI) | = 1.4.0 | No fix listed |
| pypi trytond(PyPI) | = 1.4.1 | No fix listed |
| pypi trytond(PyPI) | = 1.4.10 | No fix listed |
Show 72 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi trytond(PyPI) | = 1.4.11 | No fix listed |
| pypi trytond(PyPI) | = 1.4.12 | No fix listed |
| pypi trytond(PyPI) | = 1.4.13 | No fix listed |
| pypi trytond(PyPI) | = 1.4.2 | No fix listed |
| pypi trytond(PyPI) | = 1.4.3 | No fix listed |
| pypi trytond(PyPI) | = 1.4.4 | No fix listed |
| pypi trytond(PyPI) | = 1.4.5 | No fix listed |
| pypi trytond(PyPI) | = 1.4.6 | No fix listed |
| pypi trytond(PyPI) | = 1.4.7 | No fix listed |
| pypi trytond(PyPI) | = 1.4.8 | No fix listed |
| pypi trytond(PyPI) | = 1.4.9 | No fix listed |
| pypi trytond(PyPI) | = 1.6.0 | No fix listed |
| pypi trytond(PyPI) | = 1.6.1 | No fix listed |
| pypi trytond(PyPI) | = 1.6.10 | No fix listed |
| pypi trytond(PyPI) | = 1.6.2 | No fix listed |
| pypi trytond(PyPI) | = 1.6.3 | No fix listed |
| pypi trytond(PyPI) | = 1.6.4 | No fix listed |
| pypi trytond(PyPI) | = 1.6.5 | No fix listed |
| pypi trytond(PyPI) | = 1.6.6 | No fix listed |
| pypi trytond(PyPI) | = 1.6.7 | No fix listed |
| pypi trytond(PyPI) | = 1.6.8 | No fix listed |
| pypi trytond(PyPI) | = 1.6.9 | No fix listed |
| pypi trytond(PyPI) | = 1.8.0 | No fix listed |
| pypi trytond(PyPI) | = 1.8.1 | No fix listed |
| pypi trytond(PyPI) | = 1.8.10 | No fix listed |
| pypi trytond(PyPI) | = 1.8.11 | No fix listed |
| pypi trytond(PyPI) | = 1.8.2 | No fix listed |
| pypi trytond(PyPI) | = 1.8.3 | No fix listed |
| pypi trytond(PyPI) | = 1.8.4 | No fix listed |
| pypi trytond(PyPI) | = 1.8.5 | No fix listed |
| pypi trytond(PyPI) | = 1.8.6 | No fix listed |
| pypi trytond(PyPI) | = 1.8.7 | No fix listed |
| pypi trytond(PyPI) | = 1.8.8 | No fix listed |
| pypi trytond(PyPI) | = 1.8.9 | No fix listed |
| pypi trytond(PyPI) | = 2.0.0 | No fix listed |
| pypi trytond(PyPI) | = 2.0.1 | No fix listed |
| pypi trytond(PyPI) | = 2.0.10 | No fix listed |
| pypi trytond(PyPI) | = 2.0.11 | No fix listed |
| pypi trytond(PyPI) | = 2.0.12 | No fix listed |
| pypi trytond(PyPI) | = 2.0.13 | No fix listed |
| pypi trytond(PyPI) | = 2.0.2 | No fix listed |
| pypi trytond(PyPI) | = 2.0.3 | No fix listed |
| pypi trytond(PyPI) | = 2.0.4 | No fix listed |
| pypi trytond(PyPI) | = 2.0.5 | No fix listed |
| pypi trytond(PyPI) | = 2.0.6 | No fix listed |
| pypi trytond(PyPI) | = 2.0.7 | No fix listed |
| pypi trytond(PyPI) | = 2.0.8 | No fix listed |
| pypi trytond(PyPI) | = 2.0.9 | No fix listed |
| pypi trytond(PyPI) | = 2.2.0 | No fix listed |
| pypi trytond(PyPI) | = 2.2.1 | No fix listed |
| pypi trytond(PyPI) | = 2.2.10 | No fix listed |
| pypi trytond(PyPI) | = 2.2.11 | No fix listed |
| pypi trytond(PyPI) | = 2.2.12 | No fix listed |
| pypi trytond(PyPI) | = 2.2.13 | No fix listed |
| pypi trytond(PyPI) | = 2.2.14 | No fix listed |
| pypi trytond(PyPI) | = 2.2.2 | No fix listed |
| pypi trytond(PyPI) | = 2.2.3 | No fix listed |
| pypi trytond(PyPI) | = 2.2.4 | No fix listed |
| pypi trytond(PyPI) | = 2.2.5 | No fix listed |
| pypi trytond(PyPI) | = 2.2.6 | No fix listed |
| pypi trytond(PyPI) | = 2.2.7 | No fix listed |
| pypi trytond(PyPI) | = 2.2.8 | No fix listed |
| pypi trytond(PyPI) | = 2.2.9 | No fix listed |
| pypi trytond(PyPI) | < 2.2.4 | 2.2.4 |
| debian/tryton-server(Debian:12) | < 2.2.2-1 | 2.2.2-1 |
| debian/tryton-server(Debian:13) | < 2.2.2-1 | 2.2.2-1 |
| debian/tryton-server(Debian:14) | < 2.2.2-1 | 2.2.2-1 |
| trytond | <= 2.2.3 | No fix listed |
| trytond | = 1.4.13 | No fix listed |
| trytond | = 1.6.8 | No fix listed |
| trytond | = 1.8.7 | No fix listed |
| trytond | = 2.0.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.tryton.org
- github.com
- github.com product
- web.archive.org
- hg.tryton.org exploit patch
- news.tryton.org vendor-advisory
- DSA-2444 vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2012-0215 vendor-advisory