Tryton Trytond CVE-2017-0360 Incomplete Fix Information Disclosure Vulnerability

Tryton Trytond is prone to a information-disclosure vulnerability.

An attacker may exploit this issue to obtain sensitive information; this may lead to further attacks.

Tryton Trytond 3.x and 4.x through 4.2.2 are vulnerable.

Information

Bugtraq ID: 97489
Class: Design Error
CVE: CVE-2017-0360

Remote: Yes
Local: No
Published: Apr 04 2017 12:00AM
Credit: The vendor reported this issue.
Vulnerable: Tryton trytond 4.2.2
Tryton trytond 4.2.1
Tryton trytond 4.2
Tryton trytond 4.0.8
Tryton trytond 4.0.4
Tryton trytond 4.0.3
Tryton trytond 3.8.8
Tryton trytond 3.8.7
Tryton trytond 3.8.5
Tryton trytond 3.8.4
Tryton trytond 3.8.3
Tryton trytond 3.8.1
Tryton trytond 3.8
Tryton trytond 3.6.12
Tryton trytond 3.6.11
Tryton trytond 3.6.9
Tryton trytond 3.6.8
Tryton trytond 3.6.7
Tryton trytond 3.6.5
Tryton trytond 3.6.4
Tryton trytond 3.6
Tryton trytond 3.4.14
Tryton trytond 3.4.13
Tryton trytond 3.4.12
Tryton trytond 3.4.11
Tryton trytond 3.4.10
Tryton trytond 3.4.8
Tryton trytond 3.4.7
Tryton trytond 3.4
Tryton trytond 3.2.17
Tryton trytond 3.2.16
Tryton trytond 3.2.15
Tryton trytond 3.2.14
Tryton trytond 3.2.13
Tryton trytond 3.2.10
Tryton trytond 3.2.9
Tryton trytond 3.2
Tryton trytond 3.0
Debian Linux 6.0 sparc
Debian Linux 6.0 s/390
Debian Linux 6.0 powerpc
Debian Linux 6.0 mips
Debian Linux 6.0 ia-64
Debian Linux 6.0 ia-32
Debian Linux 6.0 arm
Debian Linux 6.0 amd64

Not Vulnerable:

References:

• [SECURITY] [DSA 3826-1] tryton-server security update (Debian)
  
• Sanitize path in file_open against suffix (Tryton)
  
• Tryton Homepage (Tryton)
  
• Trytond Home (Github)
  

Source: www.securityfocus.com