CVE-2016-1241 Tryton allows users to read the hashed password
Remote authenticated users can discover user password hashes in Tryton, exposing sensitive credential data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1241?
CVE-2016-1241 is a medium-severity vulnerability in n/a, published on 7 Sep 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.
Weakness: CWE-200
Which versions are affected by CVE-2016-1241?
12 open source packages ship an affected version, including trytond and tryton. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
trytond PyPI | All versions | 3.2.17, 3.4.14, 3.6.12, 3.8.8, 4.0.4 |
trytond PyPI | From 3.0.0 | 3.2.17 |
trytond PyPI | From 3.0.0 | 3.2.17 |
trytond PyPI | From 3.4.0 | 3.4.14 |
trytond PyPI | From 3.4.0 | 3.4.14 |
trytond PyPI | From 3.6.0 | 3.6.12 |
6 more packages
trytond PyPI | From 3.6.0 | 3.6.12 |
trytond PyPI | From 3.8.0 | 3.8.8 |
trytond PyPI | From 3.8.0 | 3.8.8 |
trytond PyPI | From 4.0.0 | 4.0.4 |
trytond PyPI | From 4.0.0 | 4.0.4 |
tryton PyPI | All versions | 3.2.17 |
Products include Tryton Tryton.
How do I fix CVE-2016-1241?
Upgrade trytond to a fixed version for your release line: 3.2.17, 3.4.14, 3.6.12 or 3.8.8.
Is CVE-2016-1241 being exploited?
There is no known exploitation of CVE-2016-1241 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2014-6633 Tryton vulnerable to arbitrary command execution
- CVE-2013-4510 Tryton Directory Traversal vulnerability
- CVE-2018-19443 Session Fixation in Tryton
- CVE-2017-0360 Tryton Information Disclosure Vulnerability
- CVE-2016-1242 Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter
Sources
Also known as DEBIAN-CVE-2016-1241, GHSA-52j9-v3jc-9xgc, PYSEC-2016-12, PYSEC-2016-40, UBUNTU-CVE-2016-1241.