Security Release for issue 15205

News
1

Clément Mercier using Claude has discovered that there is no restriction on running wizards without any model or group.

Impact

CVSS v3.0 Base Score: 8.1

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality: High
  • Integrity: High
  • Availability: None

Workaround

Add at least one group to the listed wizards in the issue via “Administration / User Interface / Actions / Wizards”.
This must also be done after the update in order to allow users to execute the said wizards.

Resolution

All affected users should upgrade trytond to the latest version and ensure that no unwanted users have been created on the system.

Affected versions per series:

  • trytond:
    • 8.2: <= 8.2.1
    • 8.0: <= 8.0.12
    • 7.8: <= 7.8.18
    • 7.0: <= 7.0.59

Not affected versions per series:

  • trytond:
    • 8.2: >= 8.2.2
    • 8.0: >= 8.0.13
    • 7.8: >= 7.8.19
    • 7.0: >= 7.0.60

Reference

Concerns?

Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the confidential checkbox checked.