Lucene search

MitreCVE-2018-14887

HistoryJun 28, 2019 - 6:15 p.m.

CVE-2018-14887

2019-06-2818:15:10

CWE-20

mitre

web.nvd.nist.gov

cve-2018-14887

improper host header

sanitization

odoo community

odoo enterprise

denial of service

disclosure

security vulnerability

nvd

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

6.2

Confidence

High

EPSS

0.002

Percentile

54.0%

JSON

Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request.

Affected configurations

Nvd

Node

odooodooMatch9.0community

odooodooMatch9.0enterprise

odooodooMatch10.0community

odooodooMatch10.0enterprise

odooodooMatch11.0community

odooodooMatch11.0enterprise

VendorProductVersionCPE
odooodoo9.0cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*
odooodoo9.0cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*
odooodoo10.0cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*
odooodoo10.0cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*
odooodoo11.0cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*
odooodoo11.0cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
odoo	odoo	9.0	cpe:2.3:a:odoo:odoo:9.0::::community:::
odoo	odoo	9.0	cpe:2.3:a:odoo:odoo:9.0::::enterprise:::
odoo	odoo	10.0	cpe:2.3:a:odoo:odoo:10.0::::community:::
odoo	odoo	10.0	cpe:2.3:a:odoo:odoo:10.0::::enterprise:::
odoo	odoo	11.0	cpe:2.3:a:odoo:odoo:11.0::::community:::
odoo	odoo	11.0	cpe:2.3:a:odoo:odoo:11.0::::enterprise:::

References

github.com/odoo/odoo/commits/master

github.com/odoo/odoo/issues/32511

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

6.2

Confidence

High

EPSS

0.002

Percentile

54.0%

JSON

Related for CVE-2018-14887