Trytond allows modification of privileges of arbitrary users

中危 5.5CVE-2012-0215 · GHSA-cqg4-rf29-3mv6 · PYSEC-2012-6 · Published 12/07/2012 · updated 16/06/2026

要点

CVE-2012-0215 是影响 trytond, trytond (tryton) 的中危 (CVSS 5.5)漏洞。
未来 30 天内被利用的概率（EPSS）：2.0%，高于 80.6% 的漏洞。
修复：升级到 2.2.4, 2.4.0 或更高版本。

Package	Affected versions	Patched versions
trytond PyPI	`< 2.2.4< 2.4.0`	`2.2.42.4.0`
trytond tryton	`= 1.4.13= 1.6.8= 1.8.7= 2.0.5≤ 2.2.3`	No fix yet

Description

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.

NVD description

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.