CVE-2015-0861 trytond arbitrary fields write via a sequence of records
Authenticated users can bypass access restrictions to write to arbitrary fields in Tryton, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-0861?
CVE-2015-0861 is a medium-severity missing authorization vulnerability in Debian Debian Linux, published on 13 Apr 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
Weakness: CWE-264
Which versions are affected by CVE-2015-0861?
9 open source packages ship an affected version, including trytond. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
trytond PyPI | From 3.2.0 | 3.2.10, 3.4.8, 3.6.5, 3.8.1 |
trytond PyPI | From 3.2.0 | 3.2.10 |
trytond PyPI | From 3.2.0 | 3.2.10 |
trytond PyPI | From 3.4.0 | 3.4.8 |
trytond PyPI | From 3.4.0 | 3.4.8 |
trytond PyPI | From 3.6.0 | 3.6.5 |
3 more packages
trytond PyPI | From 3.6.0 | 3.6.5 |
trytond PyPI | From 3.8.0 | 3.8.1 |
trytond PyPI | From 3.8.0 | 3.8.1 |
Products include Debian Debian Linux, Tryton Trytond.
How do I fix CVE-2015-0861?
Upgrade trytond to a fixed version for your release line: 3.2.10, 3.4.8, 3.6.5 or 3.8.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-0861 being exploited?
There is no known exploitation of CVE-2015-0861 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2015-0861, DSA-3425-1, GHSA-c8q5-2j73-qvcc, PYSEC-2016-11.