NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

CVE-2015-0861 — trytond

MEDIUM

CVE-2015-0861 is a medium-severity (CVSS 4.3) CWE-264 vulnerability in trytond. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for trytond — see the affected versions and patch details below.

trytond arbitrary fields write via a sequence of records

Also known asGHSA-c8q5-2j73-qvccPYSEC-2016-11
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
1 known
Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.1%probability of exploitation in next 30 days
Lower Risk-0.01%
Lower risk than most CVEs67th percentile — riskier than 67% of all scored CVEsHighest risk
0.00%0.55%1.11%1.66%0.3%1.1%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected
🐍trytond🐍trytond🐍trytond🐍trytond

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPItrytond≥ 3.2.0&&< 3.2.103.2.10pip install --upgrade 'trytond==3.2.10'
🐍PyPItrytond≥ 3.4.0&&< 3.4.83.4.8pip install --upgrade 'trytond==3.4.8'
🐍PyPItrytond≥ 3.6.0&&< 3.6.53.6.5pip install --upgrade 'trytond==3.6.5'
🐍PyPItrytond≥ 3.8.0&&< 3.8.13.8.1pip install --upgrade 'trytond==3.8.1'

Affected Products

2 products · 5 configurations
OS
debian linuxdebian
1 version
8.0
Application
trytondtryton
≥ 3.8.0 && < 3.8.1
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8…

bugs.tryton.orgNVDFeb 2019

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for trytond, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update trytond to 3.2.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2015-0861 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
O3 Security · Impact-Aware SCA

Is CVE-2015-0861 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2015-0861: trytond — Fixed in 3.2.10