BaseFortify

Publication date: 2025-11-30

Last updated on: 2025-12-04

Assigner: MITRE

Description

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-30

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-11-30

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66422

Affected Vendors & Products

Vendor	Product	Version / Range
tryton	trytond	From 6.0.0 (inc) to 6.0.70 (exc)
tryton	trytond	From 7.0.0 (inc) to 7.0.40 (exc)
tryton	trytond	From 7.4.0 (inc) to 7.4.21 (exc)
tryton	trytond	From 7.6.0 (inc) to 7.6.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-402	The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

Attack-Flow Graph

Executive Summary

This vulnerability in Tryton trytond versions before 7.6.11 allows remote attackers to obtain sensitive trace-back information related to the server setup. This means attackers can gain insight into the internal workings or configuration of the server, which could aid in further attacks. The issue is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Impact Analysis

The vulnerability can allow remote attackers to access sensitive trace-back information about the server setup, potentially exposing details that could be used to exploit other vulnerabilities or compromise the system further. Although the impact is limited to information disclosure with a low severity score (CVSS 4.3), it could still aid attackers in planning more targeted attacks.

Mitigation Strategies

Upgrade trytond to version 7.6.11 or later, or to one of the fixed versions 7.4.21, 7.0.40, or 6.0.70 to address the vulnerability.

Hi! I’m here to help you understand CVE-2025-66422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70