CVE-2016-1242 Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter

What is CVE-2016-1242?

CVE-2016-1242 is a medium-severity path traversal vulnerability in n/a, published on 7 Sep 2016. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.

Weakness: CWE-200

Which versions are affected by CVE-2016-1242?

12 open source packages ship an affected version, including trytond and tryton. It affects 1 product.

Products include Tryton Tryton.

How do I fix CVE-2016-1242?

Upgrade trytond to a fixed version for your release line: 3.2.17, 3.4.14, 3.6.12 or 3.8.8.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2016-1242 being exploited?

There is no known exploitation of CVE-2016-1242 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-6633 Tryton vulnerable to arbitrary command execution High 8.8
• CVE-2013-4510 Tryton Directory Traversal vulnerability High 7.8
• CVE-2018-19443 Session Fixation in Tryton Medium 5.9
• CVE-2017-0360 Tryton Information Disclosure Vulnerability Medium 5.3
• CVE-2016-1241 Tryton allows users to read the hashed password Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-1242, DLA-607-1, GHSA-jpr7-8rxm-4vgx, PYSEC-2016-13, PYSEC-2016-41, UBUNTU-CVE-2016-1242.