~ / search / GHSA-f6f2-pwrj-64h3

GHSA-f6f2-pwrj-64h3

Tryton Improper Access Control

Source: GitHub Advisory Database (reviewed) High CVE-2019-10868

Packages

EcosystemPackageAffectedFixed in
PyPI trytond >= 4.2.0, < 4.2.21 4.2.21
PyPI trytond >= 4.4.0, < 4.4.19 4.4.19
PyPI trytond >= 4.6.0, < 4.6.14 4.6.14
PyPI trytond >= 4.8.0, < 4.8.10 4.8.10
PyPI trytond >= 5.0.0, < 5.0.6 5.0.6

Details

As written in the advisory (Markdown source, shown as plain text).

In `trytond/model/modelstorage.py` in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.

References

External links from the advisory. They lead to third-party sites.