GHSA-7cwg-2575-3546MediumCVSS 5.3

Tryton Information Disclosure Vulnerability

Published
May 13, 2022
Last Modified
November 18, 2024

🔗 CVE IDs covered (1)

CVE-2017-0360 →

📋 Description

file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.

🎯 Affected products7

  • pip/trytond:>= 3.0.0, <= 3.0.17
  • pip/trytond:>= 3.2.0, <= 3.2.17
  • pip/trytond:>= 3.4.0, <= 3.4.17
  • pip/trytond:>= 3.6.0, <= 3.6.16
  • pip/trytond:>= 3.8.0, <= 3.8.14
  • pip/trytond:>= 4.0.0, <= 4.0.9
  • pip/trytond:>= 4.2.0, <= 4.2.2

🔗 References (8)