CVE-2012-0215 Trytond allows modification of privileges of arbitrary users
Authenticated users can escalate privileges and modify other users' permissions via RPC calls in the Tryton application framework.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-0215?
CVE-2012-0215 is a medium-severity vulnerability in n/a, published on 12 Jul 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Weakness: CWE-264
Which versions are affected by CVE-2012-0215?
3 open source packages ship an affected version, including trytond. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
trytond PyPI | All versions | 2.2.4 |
trytond PyPI | All versions | 2.4.0 |
trytond PyPI | All versions | 2.4.0 |
Products include Tryton Trytond.
How do I fix CVE-2012-0215?
Upgrade trytond to a fixed version for your release line: 2.2.4 or 2.4.0.
Is CVE-2012-0215 being exploited?
There is no known exploitation of CVE-2012-0215 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2012-2238 trytond Incorrect Authorization vulnerability
- CVE-2025-66423 trytond does not enforce access rights for the route of the HTML editor.
- CVE-2025-66424 trytond does not enforce access rights for data export
- CVE-2025-66422 trytond allows remote attackers to obtain sensitive trace-back (server setup) information
Sources
Also known as DEBIAN-CVE-2012-0215, DSA-2444-1, GHSA-cqg4-rf29-3mv6, PYSEC-2012-6.