CVE-2017-0360: Medium severity tryton vulnerability
Published Apr 4, 2017
·Updated
fileopen in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
Affected Software
106 affected componentsFixes available
pip/trytond>=4.2.0<=4.2.2
4.2.3
pip/trytond>=4.0.0<=4.0.9
pip/trytond>=3.8.0<=3.8.14
pip/trytond>=3.6.0<=3.6.16
pip/trytond>=3.4.0<=3.4.17
pip/trytond>=3.2.0<=3.2.17
pip/trytond>=3.0.0<=3.0.17
tryton Tryton=3.0.0
tryton Tryton=3.0.1
tryton Tryton=3.0.2
tryton Tryton=3.0.3
tryton Tryton=3.0.4
tryton Tryton=3.0.5
tryton Tryton=3.0.6
tryton Tryton=3.0.7
tryton Tryton=3.0.8
tryton Tryton=3.0.9
tryton Tryton=3.0.10
tryton Tryton=3.0.11
tryton Tryton=3.0.12
tryton Tryton=3.0.13
tryton Tryton=3.0.14
tryton Tryton=3.0.15
tryton Tryton=3.0.16
tryton Tryton=3.0.17
tryton Tryton=3.2.0
tryton Tryton=3.2.1
tryton Tryton=3.2.2
tryton Tryton=3.2.3
tryton Tryton=3.2.4
tryton Tryton=3.2.5
tryton Tryton=3.2.6
tryton Tryton=3.2.7
tryton Tryton=3.2.8
tryton Tryton=3.2.9
tryton Tryton=3.2.10
tryton Tryton=3.2.11
tryton Tryton=3.2.12
tryton Tryton=3.2.13
tryton Tryton=3.2.14
tryton Tryton=3.2.15
tryton Tryton=3.2.16
tryton Tryton=3.2.17
tryton Tryton=3.4.0
tryton Tryton=3.4.1
tryton Tryton=3.4.2
tryton Tryton=3.4.3
tryton Tryton=3.4.4
tryton Tryton=3.4.5
tryton Tryton=3.4.6
tryton Tryton=3.4.7
tryton Tryton=3.4.8
tryton Tryton=3.4.9
tryton Tryton=3.4.10
tryton Tryton=3.4.11
tryton Tryton=3.4.12
tryton Tryton=3.4.13
tryton Tryton=3.4.14
tryton Tryton=3.4.15
tryton Tryton=3.4.16
tryton Tryton=3.4.17
tryton Tryton=3.6.0
tryton Tryton=3.6.1
tryton Tryton=3.6.2
tryton Tryton=3.6.3
tryton Tryton=3.6.4
tryton Tryton=3.6.5
tryton Tryton=3.6.6
tryton Tryton=3.6.7
tryton Tryton=3.6.8
tryton Tryton=3.6.9
tryton Tryton=3.6.10
tryton Tryton=3.6.11
tryton Tryton=3.6.12
tryton Tryton=3.6.13
tryton Tryton=3.6.14
tryton Tryton=3.6.15
tryton Tryton=3.6.16
tryton Tryton=3.8.0
tryton Tryton=3.8.1
tryton Tryton=3.8.2
tryton Tryton=3.8.3
tryton Tryton=3.8.4
tryton Tryton=3.8.5
tryton Tryton=3.8.6
tryton Tryton=3.8.7
tryton Tryton=3.8.8
tryton Tryton=3.8.9
tryton Tryton=3.8.10
tryton Tryton=3.8.11
tryton Tryton=3.8.12
tryton Tryton=3.8.13
tryton Tryton=3.8.14
tryton Tryton=4.0.0
tryton Tryton=4.0.1
tryton Tryton=4.0.2
tryton Tryton=4.0.3
tryton Tryton=4.0.4
tryton Tryton=4.0.5
tryton Tryton=4.0.6
tryton Tryton=4.0.7
tryton Tryton=4.0.8
tryton Tryton=4.0.9
tryton Tryton=4.2.0
tryton Tryton=4.2.1
tryton Tryton=4.2.2
Event History
Apr 4, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
May 13, 2022
Advisory Published
via GitHub·01:39 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-0360?
CVE-2017-0360 has a medium severity rating due to its potential impact on data confidentiality.
2
How do I fix CVE-2017-0360?
To fix CVE-2017-0360, upgrade to Tryton version 4.2.3 or later.
3
What versions of Tryton are affected by CVE-2017-0360?
CVE-2017-0360 affects Tryton versions 3.x and 4.x up to 4.2.2.
4
Can CVE-2017-0360 be exploited remotely?
Yes, CVE-2017-0360 can be exploited by remote authenticated users with specific permissions.
5
What type of attack is associated with CVE-2017-0360?
CVE-2017-0360 is associated with a "same root name but with a suffix" attack allowing unauthorized file access.