Refine your search

6 vulnerabilities found for trytond by Tryton

CVE-2025-66424 (GCVE-0-2025-66424)
Vulnerability from nvd
Published
2025-11-30 00:00
Modified
2025-12-01 14:10
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-863 - Incorrect Authorization
Summary
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
References
Impacted products
Vendor Product Version
Tryton trytond Version: 6.0.0   ≤
Version: 7.0.0   ≤
Version: 7.1.0   ≤
Version: 7.5.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66424",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T13:33:40.959203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-01T14:10:29.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/trytond",
          "product": "trytond",
          "vendor": "Tryton",
          "versions": [
            {
              "lessThan": "6.0.70",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.40",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.4.21",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.6.11",
              "status": "affected",
              "version": "7.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.70",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.40",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.21",
                  "versionStartIncluding": "7.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.11",
                  "versionStartIncluding": "7.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-30T02:39:34.291Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discuss.tryton.org/t/security-release-for-issue-14366/8953"
        },
        {
          "url": "https://foss.heptapod.net/tryton/tryton/-/issues/14366"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-66424",
    "datePublished": "2025-11-30T00:00:00.000Z",
    "dateReserved": "2025-11-30T00:00:00.000Z",
    "dateUpdated": "2025-12-01T14:10:29.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66423 (GCVE-0-2025-66423)
Vulnerability from nvd
Published
2025-11-30 00:00
Modified
2025-12-01 14:10
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE
  • CWE-863 - Incorrect Authorization
Summary
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
References
Impacted products
Vendor Product Version
Tryton trytond Version: 6.0.0   ≤
Version: 7.0.0   ≤
Version: 7.1.0   ≤
Version: 7.5.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66423",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T13:33:32.031278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-01T14:10:34.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/trytond",
          "product": "trytond",
          "vendor": "Tryton",
          "versions": [
            {
              "lessThan": "6.0.70",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.40",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.4.21",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.6.11",
              "status": "affected",
              "version": "7.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.70",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.40",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.21",
                  "versionStartIncluding": "7.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.11",
                  "versionStartIncluding": "7.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-30T02:37:20.290Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discuss.tryton.org/t/security-release-for-issue-14364/8952"
        },
        {
          "url": "https://foss.heptapod.net/tryton/tryton/-/issues/14364"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-66423",
    "datePublished": "2025-11-30T00:00:00.000Z",
    "dateReserved": "2025-11-30T00:00:00.000Z",
    "dateUpdated": "2025-12-01T14:10:34.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66422 (GCVE-0-2025-66422)
Vulnerability from nvd
Published
2025-11-30 00:00
Modified
2025-12-01 14:10
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')
Summary
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
References
Impacted products
Vendor Product Version
Tryton trytond Version: 0   ≤
Version: 7.0.0   ≤
Version: 7.1.0   ≤
Version: 7.5.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66422",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T13:33:24.165266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-01T14:10:40.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/trytond",
          "product": "trytond",
          "vendor": "Tryton",
          "versions": [
            {
              "lessThan": "6.0.70",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.40",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.4.21",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.6.11",
              "status": "affected",
              "version": "7.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.70",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.40",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.21",
                  "versionStartIncluding": "7.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.11",
                  "versionStartIncluding": "7.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-402",
              "description": "CWE-402 Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-30T02:34:37.916Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discuss.tryton.org/t/security-release-for-issue-14354/8950"
        },
        {
          "url": "https://foss.heptapod.net/tryton/tryton/-/issues/14354"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-66422",
    "datePublished": "2025-11-30T00:00:00.000Z",
    "dateReserved": "2025-11-30T00:00:00.000Z",
    "dateUpdated": "2025-12-01T14:10:40.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66423 (GCVE-0-2025-66423)
Vulnerability from cvelistv5
Published
2025-11-30 00:00
Modified
2025-12-01 14:10
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE
  • CWE-863 - Incorrect Authorization
Summary
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
References
Impacted products
Vendor Product Version
Tryton trytond Version: 6.0.0   ≤
Version: 7.0.0   ≤
Version: 7.1.0   ≤
Version: 7.5.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66423",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T13:33:32.031278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-01T14:10:34.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/trytond",
          "product": "trytond",
          "vendor": "Tryton",
          "versions": [
            {
              "lessThan": "6.0.70",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.40",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.4.21",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.6.11",
              "status": "affected",
              "version": "7.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.70",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.40",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.21",
                  "versionStartIncluding": "7.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.11",
                  "versionStartIncluding": "7.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-30T02:37:20.290Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discuss.tryton.org/t/security-release-for-issue-14364/8952"
        },
        {
          "url": "https://foss.heptapod.net/tryton/tryton/-/issues/14364"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-66423",
    "datePublished": "2025-11-30T00:00:00.000Z",
    "dateReserved": "2025-11-30T00:00:00.000Z",
    "dateUpdated": "2025-12-01T14:10:34.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66422 (GCVE-0-2025-66422)
Vulnerability from cvelistv5
Published
2025-11-30 00:00
Modified
2025-12-01 14:10
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')
Summary
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
References
Impacted products
Vendor Product Version
Tryton trytond Version: 0   ≤
Version: 7.0.0   ≤
Version: 7.1.0   ≤
Version: 7.5.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66422",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T13:33:24.165266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-01T14:10:40.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/trytond",
          "product": "trytond",
          "vendor": "Tryton",
          "versions": [
            {
              "lessThan": "6.0.70",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.40",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.4.21",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.6.11",
              "status": "affected",
              "version": "7.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.70",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.40",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.21",
                  "versionStartIncluding": "7.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.11",
                  "versionStartIncluding": "7.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-402",
              "description": "CWE-402 Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-30T02:34:37.916Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discuss.tryton.org/t/security-release-for-issue-14354/8950"
        },
        {
          "url": "https://foss.heptapod.net/tryton/tryton/-/issues/14354"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-66422",
    "datePublished": "2025-11-30T00:00:00.000Z",
    "dateReserved": "2025-11-30T00:00:00.000Z",
    "dateUpdated": "2025-12-01T14:10:40.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66424 (GCVE-0-2025-66424)
Vulnerability from cvelistv5
Published
2025-11-30 00:00
Modified
2025-12-01 14:10
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-863 - Incorrect Authorization
Summary
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
References
Impacted products
Vendor Product Version
Tryton trytond Version: 6.0.0   ≤
Version: 7.0.0   ≤
Version: 7.1.0   ≤
Version: 7.5.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66424",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T13:33:40.959203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-01T14:10:29.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/trytond",
          "product": "trytond",
          "vendor": "Tryton",
          "versions": [
            {
              "lessThan": "6.0.70",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.40",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.4.21",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.6.11",
              "status": "affected",
              "version": "7.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.70",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.40",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.21",
                  "versionStartIncluding": "7.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.11",
                  "versionStartIncluding": "7.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-30T02:39:34.291Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discuss.tryton.org/t/security-release-for-issue-14366/8953"
        },
        {
          "url": "https://foss.heptapod.net/tryton/tryton/-/issues/14366"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-66424",
    "datePublished": "2025-11-30T00:00:00.000Z",
    "dateReserved": "2025-11-30T00:00:00.000Z",
    "dateUpdated": "2025-12-01T14:10:29.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}