CVE-2021-23203

2023-04-2519:15:09

Debian Security Bug Tracker

security-tracker.debian.org

odoo

access control

pdf download

reporting engine

remote attackers

cve-2021-23203

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

48.3%

JSON

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.

OSVersionArchitecturePackageVersionFilename
Debian11allodoo< 14.0.0+dfsg.2-7+deb11u1odoo_14.0.0+dfsg.2-7+deb11u1_all.deb
Debian999allodoo< 16.0.0+dfsg.1-1odoo_16.0.0+dfsg.1-1_all.deb