CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
77.9%
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Vendor | Product | Version | CPE |
---|---|---|---|
tryton | trytond | * | cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* |
tryton | trytond | 1.4.13 | cpe:2.3:a:tryton:trytond:1.4.13:*:*:*:*:*:*:* |
tryton | trytond | 1.6.8 | cpe:2.3:a:tryton:trytond:1.6.8:*:*:*:*:*:*:* |
tryton | trytond | 1.8.7 | cpe:2.3:a:tryton:trytond:1.8.7:*:*:*:*:*:*:* |
tryton | trytond | 2.0.5 | cpe:2.3:a:tryton:trytond:2.0.5:*:*:*:*:*:*:* |