Nixpkgs security tracker
Dismissed
Permalink
CVE-2020-37014
6.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @jopejoe1 Activity log
- Created suggestion
- @jopejoe1 ignored package tryton
- @jopejoe1 dismissed
Tryton 5.4 - Persistent Cross-Site Scripting
Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces.
References
-
ExploitDB-48466 exploit
-
Official Tryton Homepage product
-
Tryton Download Page product
-
Vulnerability Lab Advisory third-party-advisory
-
VulnCheck Advisory: Tryton 5.4 - Persistent Cross-Site Scripting third-party-advisory
Affected products
Tryton
- =<5.4
Matching in nixpkgs
pkgs.trytond
Server of the Tryton application platform
pkgs.python312Packages.trytond
Server of the Tryton application platform
pkgs.python313Packages.trytond
Server of the Tryton application platform
Package maintainers
-
@johbo Johannes Bornhold <johannes@bornhold.name>
-
@udono Udo Spallek <udono@virtual-things.biz>