Security Release for issue 15206

News
1

Clément Mercier using Claude has discovered that it is possible to retrieve the ephemeral data from the wizard execution of another user.

Impact

CVSS v3.0 Base Score: 2.6

  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality: Low
  • Integrity: None
  • Availability: None

Workaround

There is no known workaround.

Resolution

All affected users should upgrade trytond to the latest version.

Affected versions per series:

  • trytond:
    • 8.2: <= 8.2.1
    • 8.0: <= 8.0.12
    • 7.8: <= 7.8.18
    • 7.0: <= 7.0.59

Not affected versions per series:

  • trytond:
    • 8.2: >= 8.2.2
    • 8.0: >= 8.0.13
    • 7.8: >= 7.8.19
    • 7.0: >= 7.0.60

Reference

Concerns?

Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the confidential checkbox checked.