CVE-2013-4510 Tryton Directory Traversal vulnerability
A remote server can write arbitrary files to the Tryton client via path traversal in report extensions, requiring user interaction to connect.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-4510?
CVE-2013-4510 is a high-severity path traversal vulnerability in n/a, published on 15 Nov 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
Weakness: CWE-22
Which versions are affected by CVE-2013-4510?
4 open source packages ship an affected version, including trytond and tryton. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
trytond PyPI | All versions | None |
trytond PyPI | All versions | None |
trytond PyPI | All versions | None |
tryton PyPI | All versions | 3.0.1 |
Products include Tryton Tryton.
How do I fix CVE-2013-4510?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2013-4510 being exploited?
There is no known exploitation of CVE-2013-4510 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2014-6633 Tryton vulnerable to arbitrary command execution
- CVE-2018-19443 Session Fixation in Tryton
- CVE-2017-0360 Tryton Information Disclosure Vulnerability
- CVE-2016-1241 Tryton allows users to read the hashed password
- CVE-2016-1242 Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter
Sources
Also known as DEBIAN-CVE-2013-4510, DSA-2791-1, GHSA-qjmc-wwmw-cq9r, PYSEC-2013-28, PYSEC-2026-1054.