NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

CVE-2017-0360 — trytond

MEDIUMFix: tryton/trytond@30e9785

CVE-2017-0360 is a medium-severity (CVSS 5.3) Improper Privilege Management vulnerability in trytond. A fix is available for trytond — see the affected versions and patch details below.

Tryton Information Disclosure Vulnerability

Also known asGHSA-7cwg-2575-3546PYSEC-2017-97
Published
Updated
Affected
7 pkgs
Patched
1 / 7
Exploits
None indexed
Exploitation data as of Oct 27, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs75th percentile — riskier than 75% of all scored CVEsHighest risk
0.00%0.68%1.37%2.05%0.3%1.6%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

7 pkgs affected
🐍trytond🐍trytond🐍trytond🐍trytond🐍trytond🐍trytond🐍trytond

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.

Affected Packages

7 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPItrytond≥ 3.0.0No fix
🐍PyPItrytond≥ 3.2.0No fix
🐍PyPItrytond≥ 3.4.0No fix
🐍PyPItrytond≥ 3.6.0No fix
🐍PyPItrytond≥ 3.8.0No fix
🐍PyPItrytond≥ 4.0.0No fix

Affected Products

1 product · 99 configurations
Application
trytontryton
99 versions
3.0.03.0.13.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.0.103.0.11

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for trytond, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    A fix is available for CVE-2017-0360; check the affected-versions list above or the advisory for the patched release of trytond, then make sure no transitive dependency still pins the vulnerable range.

  3. Workarounds

    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.

Frequently Asked Questions

file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
O3 Security · Impact-Aware SCA

Is CVE-2017-0360 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2017-0360: trytond — Fixed in 4.2.3