Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2018-15632

HistoryDec 22, 2020 - 5:15 p.m.

CVE-2018-15632

2020-12-2217:15:12

Debian Security Bug Tracker

security-tracker.debian.org

input validation

remote attackers

database creation

default credentials

odoo community

odoo enterprise

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

0.002

Percentile

60.4%

JSON

Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials.

OSVersionArchitecturePackageVersionFilename
Debian11allodoo< 14.0.0+dfsg.2-7+deb11u2odoo_14.0.0+dfsg.2-7+deb11u2_all.deb
Debian999allodoo< 16.0.0+dfsg.2-3odoo_16.0.0+dfsg.2-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	odoo	< 14.0.0+dfsg.2-7+deb11u2	odoo_14.0.0+dfsg.2-7+deb11u2_all.deb
Debian	999	all	odoo	< 16.0.0+dfsg.2-3	odoo_16.0.0+dfsg.2-3_all.deb

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

0.002

Percentile

60.4%

JSON

Related for DEBIANCVE:CVE-2018-15632