Homepage
About Snyk

Privilege Escalation Affecting trytond package, versions [,2.4.0)

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.27% (68th percentile)
Expand this section
NVD
5.4 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-TRYTOND-40090
  • published 3 Mar 2012
  • disclosed 3 Mar 2012
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 3 Mar 2012

CVE-2012-0215 Open this link in a new tab
CWE-264 Open this link in a new tab

Overview

trytond is a Tryton server model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.

References