Read the docs
TI-2019-08092 Aliases CVE-2019-10868GHSA-f6f2-pwrj-64h3

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6…

Priority LOW 31CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.

Why it matters now

EPSS 0.01288 70th percentileScored 2026-11-07
Fix Fixed trytond (PyPI): 4.2.21, 4.4.19, 4.6.14 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—trytond (PyPI)4.2.0 to before 4.2.214.2.21Patch availableGHSA-f6f2-pwrj-64h3
—trytond (PyPI)4.4.0 to before 4.4.194.4.19Patch availableGHSA-f6f2-pwrj-64h3
—trytond (PyPI)4.6.0 to before 4.6.144.6.14Patch availableGHSA-f6f2-pwrj-64h3
—trytond (PyPI)4.8.0 to before 4.8.104.8.10Patch availableGHSA-f6f2-pwrj-64h3
—trytond (PyPI)5.0.0 to before 5.0.65.0.6Patch availableGHSA-f6f2-pwrj-64h3
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • trytond (PyPI) Vendor— Affected 4.2.0 to before 4.2.21 Fixed in 4.2.21 Patch available GHSA-f6f2-pwrj-64h3
  • trytond (PyPI) Vendor— Affected 4.4.0 to before 4.4.19 Fixed in 4.4.19 Patch available GHSA-f6f2-pwrj-64h3
  • trytond (PyPI) Vendor— Affected 4.6.0 to before 4.6.14 Fixed in 4.6.14 Patch available GHSA-f6f2-pwrj-64h3
  • trytond (PyPI) Vendor— Affected 4.8.0 to before 4.8.10 Fixed in 4.8.10 Patch available GHSA-f6f2-pwrj-64h3
  • trytond (PyPI) Vendor— Affected 5.0.0 to before 5.0.6 Fixed in 5.0.6 Patch available GHSA-f6f2-pwrj-64h3

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*4.2.0 to before 4.2.21; 4.4.0 to before 4.4.19; 4.6.0 to before 4.6.14; 4.8.0 to before 4.8.10; 5.0.0 to before 5.0.6VulnerableTryton
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.2.21; 4.4.0 to before 4.4.19; 4.6.0 to before 4.6.14; 4.8.0 to before 4.8.10; 5.0.0 to before 5.0.6 Vulnerable ·Tryton
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-f6f2-pwrj-64h3 trytond (PyPI) Fixed in 4.2.21 Advisory →
  • Fix · GHSA-f6f2-pwrj-64h3 trytond (PyPI) Fixed in 4.4.19 Advisory →
  • Fix · GHSA-f6f2-pwrj-64h3 trytond (PyPI) Fixed in 4.6.14 Advisory →
  • Fix · GHSA-f6f2-pwrj-64h3 trytond (PyPI) Fixed in 4.8.10 Advisory →
  • Fix · GHSA-f6f2-pwrj-64h3 trytond (PyPI) Fixed in 5.0.6 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10868
  2. 2026-10-03 Alias added: GHSA-f6f2-pwrj-64h3

References

Patch 1

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences