CVE-2012-0215 (GCVE-0-2012-0215)
Vulnerability from cvelistv5 – Published: 2012-07-12 20:00 – Updated: 2024-09-16 16:53
VLAI?
Summary
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:16:19.981Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-2444",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2444"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue2476"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.tryton.org/trytond/rev/8e64d52ecea4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://news.tryton.org/2012/03/security-releases-for-all-supported.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-07-12T20:00:00Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "DSA-2444",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2444"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue2476"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.tryton.org/trytond/rev/8e64d52ecea4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://news.tryton.org/2012/03/security-releases-for-all-supported.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2012-0215",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-2444",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2444"
},
{
"name": "https://bugs.tryton.org/issue2476",
"refsource": "CONFIRM",
"url": "https://bugs.tryton.org/issue2476"
},
{
"name": "http://hg.tryton.org/trytond/rev/8e64d52ecea4",
"refsource": "CONFIRM",
"url": "http://hg.tryton.org/trytond/rev/8e64d52ecea4"
},
{
"name": "http://news.tryton.org/2012/03/security-releases-for-all-supported.html",
"refsource": "CONFIRM",
"url": "http://news.tryton.org/2012/03/security-releases-for-all-supported.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2012-0215",
"datePublished": "2012-07-12T20:00:00Z",
"dateReserved": "2011-12-14T00:00:00Z",
"dateUpdated": "2024-09-16T16:53:53.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.2.3\", \"matchCriteriaId\": \"5A588F58-9CEF-40FA-B144-9C6AE832B884\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tryton:trytond:1.4.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"47EA773A-57C4-4F72-A020-E8C0E046EF8E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tryton:trytond:1.6.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"10830734-C4C0-4010-A0FC-3FA40F7C5FB7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tryton:trytond:1.8.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E23E900E-ECD6-436D-B40B-732BD3781DDB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tryton:trytond:2.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A4D14B0B-83E1-40ED-B02A-0B49435B998F\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.\"}, {\"lang\": \"es\", \"value\": \"model/modelstorage.py en el framework Tryton (trytond) anterior a v2.4.0 para Python no restringe correcteamente el acceso a el campo Many2Many en el modelo relacional, lo cual permite a usuarios remotos autenticados modificar los privilegios de usuarios arbitrarios mediante una llamada rpc (1) create, (2) write, (3) delete, or (4) copy.\"}]",
"id": "CVE-2012-0215",
"lastModified": "2024-11-21T01:34:35.840",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:N/I:P/A:P\", \"baseScore\": 5.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2012-07-12T20:55:09.857",
"references": "[{\"url\": \"http://hg.tryton.org/trytond/rev/8e64d52ecea4\", \"source\": \"security@debian.org\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"http://news.tryton.org/2012/03/security-releases-for-all-supported.html\", \"source\": \"security@debian.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.debian.org/security/2012/dsa-2444\", \"source\": \"security@debian.org\"}, {\"url\": \"https://bugs.tryton.org/issue2476\", \"source\": \"security@debian.org\"}, {\"url\": \"http://hg.tryton.org/trytond/rev/8e64d52ecea4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"http://news.tryton.org/2012/03/security-releases-for-all-supported.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.debian.org/security/2012/dsa-2444\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugs.tryton.org/issue2476\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2012-0215\",\"sourceIdentifier\":\"security@debian.org\",\"published\":\"2012-07-12T20:55:09.857\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.\"},{\"lang\":\"es\",\"value\":\"model/modelstorage.py en el framework Tryton (trytond) anterior a v2.4.0 para Python no restringe correcteamente el acceso a el campo Many2Many en el modelo relacional, lo cual permite a usuarios remotos autenticados modificar los privilegios de usuarios arbitrarios mediante una llamada rpc (1) create, (2) write, (3) delete, or (4) copy.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:P\",\"baseScore\":5.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.2.3\",\"matchCriteriaId\":\"5A588F58-9CEF-40FA-B144-9C6AE832B884\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tryton:trytond:1.4.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47EA773A-57C4-4F72-A020-E8C0E046EF8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tryton:trytond:1.6.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10830734-C4C0-4010-A0FC-3FA40F7C5FB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tryton:trytond:1.8.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E23E900E-ECD6-436D-B40B-732BD3781DDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tryton:trytond:2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4D14B0B-83E1-40ED-B02A-0B49435B998F\"}]}]}],\"references\":[{\"url\":\"http://hg.tryton.org/trytond/rev/8e64d52ecea4\",\"source\":\"security@debian.org\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://news.tryton.org/2012/03/security-releases-for-all-supported.html\",\"source\":\"security@debian.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2012/dsa-2444\",\"source\":\"security@debian.org\"},{\"url\":\"https://bugs.tryton.org/issue2476\",\"source\":\"security@debian.org\"},{\"url\":\"http://hg.tryton.org/trytond/rev/8e64d52ecea4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://news.tryton.org/2012/03/security-releases-for-all-supported.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2012/dsa-2444\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugs.tryton.org/issue2476\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…