id: PYSEC-2012-6
details: model/modelstorage.py in the Tryton application framework (trytond) before
  2.4.0 for Python does not properly restrict access to the Many2Many field in the
  relation model, which allows remote authenticated users to modify the privileges
  of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
affected:
- package:
    name: trytond
    ecosystem: PyPI
    purl: pkg:pypi/trytond
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.2.4
  versions:
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.2.0
  - 1.2.1
  - 1.2.10
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 1.4.0
  - 1.4.1
  - 1.4.10
  - 1.4.11
  - 1.4.12
  - 1.4.13
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - 1.6.0
  - 1.6.1
  - 1.6.10
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.6.5
  - 1.6.6
  - 1.6.7
  - 1.6.8
  - 1.6.9
  - 1.8.0
  - 1.8.1
  - 1.8.10
  - 1.8.11
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 1.8.5
  - 1.8.6
  - 1.8.7
  - 1.8.8
  - 1.8.9
  - 2.0.0
  - 2.0.1
  - 2.0.10
  - 2.0.11
  - 2.0.12
  - 2.0.13
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.0.7
  - 2.0.8
  - 2.0.9
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
references:
- type: ADVISORY
  url: http://www.debian.org/security/2012/dsa-2444
- type: WEB
  url: http://news.tryton.org/2012/03/security-releases-for-all-supported.html
- type: WEB
  url: https://bugs.tryton.org/issue2476
- type: WEB
  url: http://hg.tryton.org/trytond/rev/8e64d52ecea4
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cqg4-rf29-3mv6
aliases:
- CVE-2012-0215
- GHSA-cqg4-rf29-3mv6
modified: "2021-07-05T00:01:27.407587Z"
published: "2012-07-12T20:55:00Z"