tryton/trytond · Security
Tryton allows users to read the hashed password
- GHSA ID
- GHSA-52j9-v3jc-9xgc
- CVE ID
- CVE-2016-1241
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v4
- 6 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-1241 ↗
- https://bugs.tryton.org/issue5795 ↗
- http://www.debian.org/security/2016/dsa-3656 ↗
- http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html ↗
- https://github.com/tryton/trytond/commit/11424d57b7838381745655e2e89470ff9087cd27 ↗
- https://github.com/tryton/trytond/commit/30d2a6dcaf09340829cd70ee8a15a4941ca7161a ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2016-12.yaml ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/tryton/PYSEC-2016-40.yaml ↗
- https://github.com/advisories/GHSA-52j9-v3jc-9xgc ↗