CVE-2018-19443 - CVE House
Back to Database
Status published Medium CVE-2018-19443

The client in Tryton 5.x before 5.0.1 tries to make...

Vulnerability Description

The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19443

Credits & Attribution

No credits recorded in the NVD database.

References

More from tryton

View All →
CVE-2022-26662
An XML Entity Expansion (XEE) issue was discovered in Tryton...
High 7.5
CVE-2022-26661
An XXE issue was discovered in Tryton Application Platform (Server)...
Medium 6.5
CVE-2019-10868
In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19,...
Medium 4.3
CVE-2016-1242
file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before...
Medium 4.4
CVE-2016-1241
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12,...
Medium 5.3

Affected Vendor

Affected Software

tryton
Vulnerable Versions:
5.0.0

Timeline

Official Publish: November 22nd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.