CVSS 3.0
4.3 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVE-2015-0861
Medium (4.3). EPSS 1.2% chance of exploitation in the next 30 days. Fixed in trytond 3.2.10, 3.4.8, 3.6.5.
model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- tryton:trytond
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c8q5-2j73-qvcc | PyPI | trytond | >=3.2.0 <3.2.10 | 3.2.10 |
| GHSA-c8q5-2j73-qvcc | PyPI | trytond | >=3.4.0 <3.4.8 | 3.4.8 |
| GHSA-c8q5-2j73-qvcc | PyPI | trytond | >=3.6.0 <3.6.5 | 3.6.5 |
| GHSA-c8q5-2j73-qvcc | PyPI | trytond | >=3.8.0 <3.8.1 | 3.8.1 |
| PYSEC-2016-11 | PyPI | trytond | >=3.2.0 <3.2.10 >=3.4.0 <3.4.8 >=3.6.0 <3.6.5 >=3.8.0 <3.8.1 | 3.2.10, 3.4.8, 3.6.5, 3.8.1 |