Lucene search

GoogleOSV:BIT-ODOO-2021-23203

HistoryMar 06, 2024 - 11:01 a.m.

BIT-odoo-2021-23203

2024-03-0611:01:04

Google

osv.dev

odoo

access control

remote attackers

pdf reports

crafted requests

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

48.3%

JSON

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.

CPENameOperatorVersion
odoole14.0.0
odoole15.0.0
odooge14.0.0
odooge15.0.0

Name	Operator	Version
odoo	le	14.0.0
odoo	le	15.0.0
odoo	ge	14.0.0
odoo	ge	15.0.0

References

github.com/odoo/odoo/issues/107695

www.debian.org/security/2023/dsa-5399

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

48.3%

JSON

Related for OSV:BIT-ODOO-2021-23203