CVE-2012-0215 json
Trytond allows modification of privileges of arbitrary users
published 2012-07-12 14 y ago modified 2026-06-16 4 mo ago also GHSA-cqg4-rf29-3mv6 , PYSEC-2012-6 , EUVD-2012-0030
- cvss
- 6.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Patch / fix
- pypi trytond 2.2.4, 2.4.0
- tryton-server Debian 14, Debian 13, Debian 12 2.2.2-1
debian advisories DEBIAN-CVE-2012-0215
Exploit prediction
2.02% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- hg.tryton.org http://hg.tryton.org/trytond/rev/8e64d52ecea4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | trytond | <2.4.0 <2.2.4 |
2.4.0 2.2.4 |
Classification
References
-
hg.tryton.org
/trytond/rev/8e64d52ecea4
web, exploit, patch
-
github.com
/tryton/trytond/commit/d059ebb792401ded3129cd9402d7392dc34b81e3
web
-
debian.org
/security/2012/dsa-2444
vendor-advisory, web, advisory
-
news.tryton.org
/2012/03/security-releases-for-all-supported.html
web, vendor-advisory
-
bugs.tryton.org
/issue2476
web
-
nvd.nist.gov
/vuln/detail/CVE-2012-0215
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2012-6.yaml
web
-
github.com
/tryton/trytond
package
-
web.archive.org
/web/20121113201043/http://news.tryton.org/2012/03/security-releases-for-all-supported.html
web
-
github.com
/advisories/GHSA-cqg4-rf29-3mv6
advisory
Sources
- CVE List CVE-2012-0215
- GitHub Advisory GHSA-cqg4-rf29-3mv6
- NVD CVE-2012-0215
- OSV PYSEC-2012-6
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.