CVE-2015-0861: trytond arbitrary fields write via a sequence of records

May 14, 2022 (updated November 18, 2024)

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.

References

bugs.tryton.org/issue5167
foss.heptapod.net/tryton/tryton/-/commit/06230c381593c79766c4d8dcc92da3391e3acad2
github.com/advisories/GHSA-c8q5-2j73-qvcc
github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2016-11.yaml
github.com/tryton/trytond
nvd.nist.gov/vuln/detail/CVE-2015-0861

Code Behaviors & Features

Detect and mitigate CVE-2015-0861 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →