CVE-2012-0215

Severity: medium (CVSS 5.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-07-12 · updated 2026-06-16
Weakness: CWE-264

Description

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.

Affected products

trytond: through 2.2.3; 1.4.13, 1.6.8, 1.8.7, 2.0.5

References

http://hg.tryton.org/trytond/rev/8e64d52ecea4
http://news.tryton.org/2012/03/security-releases-for-all-supported.html
http://www.debian.org/security/2012/dsa-2444
https://bugs.tryton.org/issue2476
http://hg.tryton.org/trytond/rev/8e64d52ecea4
http://news.tryton.org/2012/03/security-releases-for-all-supported.html
http://www.debian.org/security/2012/dsa-2444
https://bugs.tryton.org/issue2476

Get alerted when CVE-2012-0215 or the next vulnerability affects your stack