CVE-2017-0360

MEDIUM

Tryton - Improper Privilege Management

Title source: rule

Description

file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.

References (4)

[Various Sources] http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97489

[Third Party Advisory] https://lists.debian.org/debian-security-announce/2017/msg00084.html

[Third Party Advisory] http://www.debian.org/security/2017/dsa-3826

Scores

CVSS v3 5.3

EPSS 0.0032

EPSS Percentile 54.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-269

Status published

Affected Products (50)

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

tryton/tryton

... and 35 more

Timeline

Published Apr 04, 2017

Tracked Since Feb 18, 2026