Lucene search

PRIOn knowledge basePRION:CVE-2012-0215

HistoryJul 12, 2012 - 8:55 p.m.

Code injection

2012-07-1220:55:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

0.003 Low

EPSS

Percentile

67.4%

JSON

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.

CPENameOperatorVersion
trytondeq2.0.5
trytondeq1.6.8
trytondle2.2.3
trytondeq1.8.7
trytondeq1.4.13

Name	Operator	Version
trytond	eq	2.0.5
trytond	eq	1.6.8
trytond	le	2.2.3
trytond	eq	1.8.7
trytond	eq	1.4.13

References

hg.tryton.org/trytond/rev/8e64d52ecea4

news.tryton.org/2012/03/security-releases-for-all-supported.html

www.debian.org/security/2012/dsa-2444

bugs.tryton.org/issue2476

6.7 Medium

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

0.003 Low

EPSS

Percentile

67.4%

JSON

Related for PRION:CVE-2012-0215