Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
13 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Recommended action: Upgrade to 7.6.11, 7.4.21, 7.0.40 or 6.0.70 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Recommended action: Upgrade to 7.6.11, 7.4.21, 7.0.40 or 6.0.70 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Recommended action: Upgrade to 7.6.11, 7.4.21, 7.0.40 or 6.0.70 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.4.143.6.123.8.83.2.174.0.4· Vendor fix available
Issue
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.
Recommended action: Upgrade to 4.0.4, 3.8.8, 3.6.12 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.4.143.6.123.8.83.2.174.0.4· Vendor fix available
Issue
fileopen in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.
Recommended action: Upgrade to 4.0.4, 3.8.8, 3.6.12 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.2.32.4.153.0.72.6.142.8.11· Vendor fix available
Issue
The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the pricelist module.
Recommended action: Upgrade to 3.2.3, 3.0.7, 2.8.11 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
Recommended action: Upgrade to 3.8.1, 3.6.5, 3.4.8 or 3.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
fileopen in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
Recommended action: Upgrade to 4.2.3; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Recommended action: Upgrade to 2.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
trytond 2.4: ModelView.button fails to validate authorization.
Recommended action: Upgrade to 2.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
Recommended action: Upgrade to 6.2.6, 6.0.16 or 5.0.46 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
Recommended action: Upgrade to 6.2.6, 6.0.16 or 5.0.46 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.6.144.8.104.4.194.2.215.0.6· Vendor fix available
Issue
In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.
Recommended action: Upgrade to 5.0.6, 4.8.10, 4.6.14 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.