trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2025-66422 · ADVISORY
• discuss.tryton.org/t/security-release-for-issue-14354/8950 · WEB
• foss.heptapod.net/tryton/tryton/-/issues/14354 · WEB
• tryton/trytond · PACKAGE
• pypi.org/project/trytond · PACKAGE
• GitHub Advisory GHSA-jqfc-9q34-prhg · ADVISORY

Lỗ hổng khác của trytond

• CVE-2025-66424TRUNG BÌNH 6.5Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
• CVE-2025-66423CAO 7.1Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, a…
• CVE-2022-26662CAO 7.5An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x…
• CVE-2022-26661TRUNG BÌNH 6.5An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.…
• CVE-2012-2238CAO 7.5trytond 2.4: ModelView.button fails to validate authorization