CVE-2019-10868 - In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right

Back Back to CVE browser

HIGH

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right

Published Apr 5, 2019

7.1

HIGH

CVSS 4.0

EPSS 1.26%

Description

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (8)

https://discuss.tryton.org/t/security-release-for-issue8189/1262
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0144
Advisory
https://github.com/advisories/GHSA-f6f2-pwrj-64h3
Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2019-127.yaml
https://hg.tryton.org/trytond/rev/f58bbfe0aefb
x_refsource_MISCPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10868
https://seclists.org/bugtraq/2019/Apr/14
mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
https://www.debian.org/security/2019/dsa-4426
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
https://discuss.tryton.org/t/security-release-for-issue8189/1262		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0144		Advisory
https://github.com/advisories/GHSA-f6f2-pwrj-64h3		Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2019-127.yaml
https://hg.tryton.org/trytond/rev/f58bbfe0aefb		x_refsource_MISCPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10868
https://seclists.org/bugtraq/2019/Apr/14		mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
https://www.debian.org/security/2019/dsa-4426		vendor-advisoryx_refsource_DEBIANThird Party Advisory