CVE-2019-10868

Description

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.277

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond 4.2.21	Windows
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond 4.4.19	Windows
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond 4.6.14	Windows
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond 4.8.10	Windows
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond 5.0.6	Windows
tryton-server security update(DSA-4426-1) tryton-server_4.2.1-2+deb9u1_all.deb	Linux
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond for linux 4.2.21	Linux
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond for linux 4.4.19	Linux
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond for linux 4.6.14	Linux
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond for linux 4.8.10	Linux
Vulnerabilities CVE-2019-10868 are fixed in Python-trytond for linux 5.0.6	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234