What is GHSA-c8q5-2j73-qvcc?

GHSA-c8q5-2j73-qvcc is a security advisory published by GitHub Security Advisories with Medium severity. trytond arbitrary fields write via a sequence of records

Which CVE IDs does GHSA-c8q5-2j73-qvcc cover?

GHSA-c8q5-2j73-qvcc covers the following CVE IDs: CVE-2015-0861. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c8q5-2j73-qvcc?

GHSA-c8q5-2j73-qvcc has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-c8q5-2j73-qvcc?

GHSA-c8q5-2j73-qvcc affects 4 products, including: pip/trytond:\u003e= 3.2.0, \u003c 3.2.10; pip/trytond:\u003e= 3.4.0, \u003c 3.4.8; pip/trytond:\u003e= 3.6.0, \u003c 3.6.5; pip/trytond:\u003e= 3.8.0, \u003c 3.8.1.

GHSA-c8q5-2j73-qvccMediumCVSS 4.3

trytond arbitrary fields write via a sequence of records

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2015-0861 →

📋 Description

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.

🎯 Affected products4

pip/trytond:>= 3.2.0, < 3.2.10
pip/trytond:>= 3.4.0, < 3.4.8
pip/trytond:>= 3.6.0, < 3.6.5
pip/trytond:>= 3.8.0, < 3.8.1

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2015-0861
https://bugs.tryton.org/issue5167
http://www.debian.org/security/2015/dsa-3425
http://www.tryton.org/posts/security-release-for-issue5167.html
https://foss.heptapod.net/tryton/tryton/-/commit/06230c381593c79766c4d8dcc92da3391e3acad2
https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2016-11.yaml
https://github.com/advisories/GHSA-c8q5-2j73-qvcc