trytond does not enforce access rights for data export

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2025-66424 · ADVISORY
• discuss.tryton.org/t/security-release-for-issue-14366/8953 · WEB
• foss.heptapod.net/tryton/tryton/-/issues/14366 · WEB
• tryton/trytond · PACKAGE
• pypi.org/project/trytond · PACKAGE
• GitHub Advisory GHSA-2w93-qwpp-vgvj · ADVISORY

Lỗ hổng khác của trytond

• CVE-2025-66423CAO 7.1Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, a…
• CVE-2025-66422TRUNG BÌNH 4.3Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4…
• CVE-2022-26662CAO 7.5An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x…
• CVE-2022-26661TRUNG BÌNH 6.5An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.…
• CVE-2012-2238CAO 7.5trytond 2.4: ModelView.button fails to validate authorization