CVE-2019-10868

Description

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.

How to fix CVE-2019-10868

To remediate CVE-2019-10868, upgrade the affected package to a fixed version below.

• —upgrade to 5.0.4-2 or later
• —upgrade to 4.2.1-2+deb9u1 or later
• —upgrade to 4.2.21 or later
• —upgrade to 4.2.21 or later

Is CVE-2019-10868 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 5.0.4-2
• from 0, < 4.2.1-2+deb9u1
• >= 4.2.0, < 4.2.21
• >= 4.2.0, < 4.2.21, >= 4.4.0, < 4.4.19, >= 4.6.0, < 4.6.14, >= 4.8.0, < 4.8.10, >= 5.0.0, < 5.0.6

CVSS scores

References (9)

• ADVISORYgithub.com/advisories/GHSA-f6f2-pwrj-64h3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-10868
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2019-10868
• PATCHgithub.com/tryton/trytond
• WEB