CVE-2025-66422
BaseFortify
Publication date: 2025-11-30
Last updated on: 2025-12-04
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tryton | trytond | From 6.0.0 (inc) to 6.0.70 (exc) |
| tryton | trytond | From 7.0.0 (inc) to 7.0.40 (exc) |
| tryton | trytond | From 7.4.0 (inc) to 7.4.21 (exc) |
| tryton | trytond | From 7.6.0 (inc) to 7.6.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-402 | The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Tryton trytond versions before 7.6.11 allows remote attackers to obtain sensitive trace-back information related to the server setup. This means attackers can gain insight into the internal workings or configuration of the server, which could aid in further attacks. The issue is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
How can this vulnerability impact me? :
The vulnerability can allow remote attackers to access sensitive trace-back information about the server setup, potentially exposing details that could be used to exploit other vulnerabilities or compromise the system further. Although the impact is limited to information disclosure with a low severity score (CVSS 4.3), it could still aid attackers in planning more targeted attacks.
What immediate steps should I take to mitigate this vulnerability?
Upgrade trytond to version 7.6.11 or later, or to one of the fixed versions 7.4.21, 7.0.40, or 6.0.70 to address the vulnerability.