diff --git a/CHANGELOG b/CHANGELOG
index 8f12ad3ff8..f14be99ab2 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Fix search button clause in ModelButton.get_groups (CVE-2012-2238)
 * Merge all kind of buttons
 * Use XML id for board action instead of id
 * Add states attribute to notebook
diff --git a/trytond/ir/model.py b/trytond/ir/model.py
index cfff099a6c..d25096559f 100644
--- a/trytond/ir/model.py
+++ b/trytond/ir/model.py
@@ -555,7 +555,7 @@ class ModelButton(ModelSQL, ModelView):
         Return a set of group ids for the named button on the model.
         '''
         button_ids = self.search([
-                ('model', '=', model),
+                ('model.model', '=', model),
                 ('name', '=', name),
                 ])
         if not button_ids: