CVE-2016-1242: Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter

Quick answers

Is CVE-2016-1242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-1242 being exploited in the wild.

How severe is CVE-2016-1242?

Low severity, with a CVSS score of 3, published 7 September 2016.

Which products and versions are affected?

tryton (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.17; trytond (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.17, ECOSYSTEM:introduced=0,fixed=3.2.17,introduced=3.4,fixed=3.4.14,introduced=3.6,fixed=3.6.12,introduced=3.8,fixed=3.8.8,introduced=4.0,fixed=4.0.4.

Is there a fix for CVE-2016-1242?

Yes. tryton (PyPI): upgrade to 3.2.17 or later; trytond (PyPI): upgrade to 3.2.17, 4.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2016-1242?

Check whether you run tryton (PyPI) or trytond (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• tryton (PyPI): upgrade to 3.2.17 or later

  pip install "tryton>=3.2.17"

• trytond (PyPI): upgrade to 3.2.17, 4.0.4 or later

  pip install "trytond>=4.0.4"

Affected products

• tryton (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.17
• trytond (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.17, ECOSYSTEM:introduced=0,fixed=3.2.17,introduced=3.4,fixed=3.4.14,introduced=3.6,fixed=3.6.12,introduced=3.8,fixed=3.8.8,introduced=4.0,fixed=4.0.4

Identifiers

• CVE-2016-1242
• GHSA-jpr7-8rxm-4vgx
• PYSEC-2016-13
• PYSEC-2016-41