{"resultsPerPage":59,"startIndex":0,"totalResults":59,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-08T21:59:32.452","vulnerabilities":[{"cve":{"id":"CVE-2017-9416","sourceIdentifier":"cve@mitre.org","published":"2017-06-04T21:29:00.420","lastModified":"2026-06-17T01:28:03.560","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service."},{"lang":"es","value":"Una vulnerabilidad de salto de directorio en tools.file_open en Odoo versiones 8.0, 9.0 y 10.0, permite a los usuarios autenticados remotos leer archivos locales arbitrarios legibles por el servicio de Odoo."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*","matchCriteriaId":"9D140CBF-E659-4E87-8FEE-F19CD2E6B947"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:*:*:*:*","matchCriteriaId":"59408702-9C9E-4F25-85FB-D4F9AD4949BC"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:*:*:*:*","matchCriteriaId":"A75A14CA-5B6C-4324-B5E5-BED6890D1426"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/17394","source":"cve@mitre.org","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/17394","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-10803","sourceIdentifier":"cve@mitre.org","published":"2017-07-04T18:29:00.177","lastModified":"2026-06-17T01:00:44.137","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used."},{"lang":"es","value":"En Odoo versión 8.0, Odoo Community Edition versiones 9.0 y 10.0, y Odoo Enterprise Edition versiones 9.0 y 10.0, el manejo no seguro de datos de anonimización en el módulo de Anonimización de Base de Datos permite que los usuarios privilegiados identificados remotos ejecuiten código Python arbitrario, porque es utilizado unpickle."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.6,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:C/A:C","baseScore":8.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.8,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*","matchCriteriaId":"9D140CBF-E659-4E87-8FEE-F19CD2E6B947"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/17898","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/17898","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-10804","sourceIdentifier":"cve@mitre.org","published":"2017-07-04T18:29:00.227","lastModified":"2026-06-17T01:00:44.267","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used."},{"lang":"es","value":"En Odoo versión 8.0, Odoo Community Edition versiones 9.0 y 10.0, y Odoo Community Edition versiones 9.0 y 10.0, los atacantes remotos pueden omitir la identificación bajo ciertas circunstancias porque los parámetros que contienen caracteres 0x00 están truncados antes de alcanzar la capa de base de datos. Esto ocurre porque es usado Psycopg versión 2.x anterior a 2.6.3."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*","matchCriteriaId":"9D140CBF-E659-4E87-8FEE-F19CD2E6B947"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"}]}]}],"references":[{"url":"http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/odoo/odoo/issues/17914","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/psycopg/psycopg2/issues/420","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"]},{"url":"https://github.com/odoo/odoo/issues/17914","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/psycopg/psycopg2/issues/420","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-10805","sourceIdentifier":"cve@mitre.org","published":"2017-07-04T18:29:00.273","lastModified":"2026-06-17T01:00:44.393","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users."},{"lang":"es","value":"En Odoo versión 8.0, Odoo Community Edition versiones 9.0 y 10.0, y Odoo Enterprise Edition versiones 9.0 y 10.0, un control de acceso incorrecto en los tokens OAuth en el módulo OAuth permite a los usuarios identificados secuestrar las sesiones OAuth de otros usuarios."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*","matchCriteriaId":"9D140CBF-E659-4E87-8FEE-F19CD2E6B947"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/17921","source":"cve@mitre.org","tags":["Mitigation","Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/17921","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15631","sourceIdentifier":"security@odoo.com","published":"2019-04-09T16:29:01.087","lastModified":"2026-06-17T01:42:51.450","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request."},{"lang":"es","value":"El control de acceso inadecuado en la aplicación de discusión de Odoo Community 12.0 y anterior, y Odoo Enterprise 12.0 y anterior permite a los atacantes identificados remotos enviarse por correo electrónico archivos arbitrarios de la base de datos, a través de una petición RPC diseñada."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"A958BCBB-C656-44A5-A9A9-66A66AEA67A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"059733D6-977F-4731-BA24-36F6F50F76AB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32516","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.excellium-services.com/cert-xlm-advisory/cve-2018-15631/","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32516","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.excellium-services.com/cert-xlm-advisory/cve-2018-15631/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15635","sourceIdentifier":"security@odoo.com","published":"2019-04-09T16:29:01.130","lastModified":"2026-06-17T01:42:51.973","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a crafted name."},{"lang":"es","value":"La vulnerabilidad de tipo Cross-site scripting en la aplicación Discuss de Odoo Community versión 12.0 y anteriores, y Odoo Enterprise versión 12.0 y anteriores, permite a los atacantes remotos inyectar un script web arbitrario en el navegador de un usuario interno del sistema engañándolos para que inviten a un seguidor de un documento con un nombre creado."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"A958BCBB-C656-44A5-A9A9-66A66AEA67A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"059733D6-977F-4731-BA24-36F6F50F76AB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32515","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32515","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15640","sourceIdentifier":"security@odoo.com","published":"2019-04-09T16:29:01.193","lastModified":"2026-06-17T01:42:52.270","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request."},{"lang":"es","value":"El control de acceso inapropiado en la aplicación Helpdesk de Odoo Enterprise versión 10.0 hasta la 12.0, permite que los atacantes autenticados remotos puedan obtener privilegios elevados por medio de una petición creada."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"},{"version":"10.0","lessThan":"unspecified","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"10.0","versionEndIncluding":"12.0","matchCriteriaId":"A4C406AC-8BCE-431E-9E09-7A793E3C750F"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32514","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32514","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-5871","sourceIdentifier":"cve@mitre.org","published":"2019-05-22T20:29:00.433","lastModified":"2026-06-17T01:21:21.510","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote)."},{"lang":"es","value":"Odoo Versión <= 8.0-20160726 y Versión 9, es afectada por: CWE-601: Redirección abierta. El impacto es: obtener información confidencial (remota)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*","matchCriteriaId":"9D140CBF-E659-4E87-8FEE-F19CD2E6B947"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:20160726:*:*:*:*:*:*","matchCriteriaId":"D8D22138-711E-4A13-80C5-B52C66565BD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:*:*:*:*","matchCriteriaId":"59408702-9C9E-4F25-85FB-D4F9AD4949BC"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:*:*:*:*","matchCriteriaId":"A75A14CA-5B6C-4324-B5E5-BED6890D1426"}]}]}],"references":[{"url":"https://sysdream.com/news/lab/2017-11-20-cve-2017-5871-odoo-url-redirection-to-distrusted-site-open-redirect/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.odoo.com","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://sysdream.com/news/lab/2017-11-20-cve-2017-5871-odoo-url-redirection-to-distrusted-site-open-redirect/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.odoo.com","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2018-14867","sourceIdentifier":"cve@mitre.org","published":"2019-06-28T18:15:10.410","lastModified":"2026-06-17T01:41:47.433","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters."},{"lang":"es","value":"El control de acceso incorrecto en el sistema de mensajería del portal en Odoo Community versiones 9.0 y 10.0 y Odoo Enterprise versiones 9.0 y 10.0 permite a los atacantes remotos publicar mensajes en nombre de los clientes y adivinar los valores de los atributos de los documentos, a través de parámetros diseñados."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/commits/master","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32503","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/commits/master","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32503","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14868","sourceIdentifier":"cve@mitre.org","published":"2019-06-28T18:15:10.473","lastModified":"2026-06-17T01:41:47.563","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call."},{"lang":"es","value":"Un control de acceso incorrecto en el módulo de cifrado de las contraseñas en Odoo Community versión 9.0 y Odoo Enterprise versión 9.0 permite a los atacantes autenticados cambiar la contraseña de otros usuarios sin conocer su contraseña actual mediante una llamada RPC manipulada."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/commits/master","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32507","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/commits/master","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32507","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14885","sourceIdentifier":"cve@mitre.org","published":"2019-06-28T18:15:10.520","lastModified":"2026-06-17T01:41:49.993","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds."},{"lang":"es","value":"Un control de acceso incorrecto en el componente Database Manager en Odoo Community versión 10.0 y versión 11.0 y Odoo Enterprise versión 10.0 y versión 11.0 permite que un atacante remoto recuperar una copia de la base de datos sin conocer la contraseña de super-administrador. Tiene éxito un contraseña arbitraria."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/commits/master","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32512","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/commits/master","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32512","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14886","sourceIdentifier":"cve@mitre.org","published":"2019-06-28T18:15:10.567","lastModified":"2026-06-17T01:41:50.130","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description."},{"lang":"es","value":"El procesador de descripción de módulos en Odoo Community versión 11.0 y versiones anteriores y Odoo Enterprise versión 11.0 y versiones anteriores no deshabilita la inclusión de archivos locales de RST, lo que permite a los usuarios autenticados privilegiados leer archivos locales a través de una descripción de módulo manipulada."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/commits/master","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32513","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/commits/master","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32513","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14887","sourceIdentifier":"cve@mitre.org","published":"2019-06-28T18:15:10.613","lastModified":"2026-06-17T01:41:50.250","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request."},{"lang":"es","value":"Un saneamiento inadecuado de la cabecera Host en el componente de enrutamiento dbfilter en Odoo Community versión 11.0 y versiones anteriores y Odoo Enterprise versión 11.0 y anteriores permite que los atacantes remotos denieguen el acceso al servicio y revelar los nombres de base de datos mediante una petición creada."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":4.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/commits/master","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32511","source":"cve@mitre.org","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/commits/master","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32511","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14866","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T18:15:10.317","lastModified":"2026-06-17T01:41:47.313","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs."},{"lang":"es","value":"El control de acceso incorrecto en el marco de TransientModel en Odoo Community 11.0 y versiones anteriores y Odoo Enterprise 11.0 y versiones anteriores permite que los atacantes identificados accedan a datos en registros transitorios que no poseen al realizar una llamada RPC antes de que se produzca la recolección de basura."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32509","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32509","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14861","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T19:15:10.503","lastModified":"2026-06-17T01:41:46.683","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users."},{"lang":"es","value":"El control de acceso a los datos indebidos en Odoo Community versión 10.0 y versión 11.0 y Odoo Enterprise versión 10.0 y versión 11.0 permite a los usuarios autenticados realizar una exportación CSV de las contraseñas seguras de hash de otros usuarios."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32506","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32506","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14862","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T19:15:10.580","lastModified":"2026-06-17T01:41:46.810","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request."},{"lang":"es","value":"Un control de acceso incorrecto en el sistema de plantillas de correo en Odoo Community versión 11.0 y versiones anteriores y Odoo Enterprise versión 11.0 y versiones anteriores permite a los usuarios internos autenticados eliminar menuitems arbitrarios a través de una solicitud RPC diseñada."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32504","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32504","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14863","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T19:15:10.643","lastModified":"2026-06-17T01:41:46.937","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC."},{"lang":"es","value":"El control de acceso incorrecto en el marco de RPC en Odoo Community 8.0 a 11.0 y Odoo Enterprise 9.0 a 11.0 permite a los usuarios identificados llamar a funciones privadas a través de RPC."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32508","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32508","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14864","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T19:15:10.707","lastModified":"2026-06-17T01:41:47.067","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment."},{"lang":"es","value":"El control de acceso incorrecto en los paquetes de activos en Odoo Community 9.0 a 11.0 y anteriores y Odoo Enterprise 9.0 a 11.0 y anteriores permite a los usuarios identificados remotamente inyectar un script web arbitrario a través de un adjunto diseñado."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:community:*:*:*","matchCriteriaId":"705E446A-98DC-43D6-905A-F52E3FDCAF48"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"F8E37238-5C5A-41E4-8D46-48446E539277"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32502","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32502","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14865","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T19:15:10.767","lastModified":"2026-06-17T01:41:47.183","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files."},{"lang":"es","value":"El motor de informes en Odoo Community versión 9.0 hasta la versión 11.0 y versiones anteriores y Odoo Enterprise versión 9.0 hasta la versión 11.0 y versiones anteriores no usa opciones seguras al pasar documentos a wkhtmltopdf, lo que permite a los atacantes remotos leer archivos locales."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32501","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32501","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14859","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T20:15:10.777","lastModified":"2026-06-17T01:41:46.427","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token."},{"lang":"es","value":"El control de acceso incorrecto en el componente de restablecimiento de contraseña en Odoo Community versión 11.0 y versiones anteriores y Odoo Enterprise versión 11.0 y versiones anteriores permite a los usuarios autenticados restablecer la contraseña de otros usuarios al ser la primera persona en utilizar el token seguro."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32510","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32510","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14860","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T20:15:10.837","lastModified":"2026-06-17T01:41:46.557","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system."},{"lang":"es","value":"El saneamiento inadecuado de las expresiones de usuario dinámicas en Odoo Community versión 11.0 y versiones anteriores y Odoo Enterprise versión 11.0 y versiones anteriores permite a los usuarios con privilegios autenticados un escape de sanbox de expresiones dinámicas y ejecutar código arbitrario en el sistema de alojamiento."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"11.0","matchCriteriaId":"D9126A1A-FA35-4127-91B3-A3FA8B26FABB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"11.0","matchCriteriaId":"9ACA123F-EF25-4E9D-8D60-4368B2F25FA0"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/32505","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/32505","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14733","sourceIdentifier":"cve@mitre.org","published":"2019-07-05T20:15:13.907","lastModified":"2026-06-17T01:41:32.310","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) under certain circumstances."},{"lang":"es","value":"El módulo dbfilter_from_header de Odoo Community Association (OCA), hace que Odoo versiones 8.x, 9.x, 10.x y 11.x sea vulnerable a un problema de tipo ReDoS (denegación de servicio de expresiones regulares) bajo ciertas circunstancias."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:community:*:*:*","matchCriteriaId":"705E446A-98DC-43D6-905A-F52E3FDCAF48"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:8.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"F8E37238-5C5A-41E4-8D46-48446E539277"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*","matchCriteriaId":"C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"167C709E-C8B2-4CCB-963E-E1D8C664190A"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*","matchCriteriaId":"C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"A4405E54-6C16-49D5-B632-3D72091B2FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*","matchCriteriaId":"38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1298CF62-A06E-48AD-8141-0541DE3F6381"}]}]}],"references":[{"url":"https://github.com/OCA/server-tools/issues/1335","source":"cve@mitre.org","tags":["Mitigation","Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/10.0/dbfilter_from_header","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/11.0/dbfilter_from_header","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/8.0/dbfilter_from_header","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/9.0/dbfilter_from_header","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/issues/1335","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/10.0/dbfilter_from_header","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/11.0/dbfilter_from_header","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/8.0/dbfilter_from_header","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/OCA/server-tools/tree/9.0/dbfilter_from_header","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-15564","sourceIdentifier":"cve@mitre.org","published":"2019-08-26T15:15:12.313","lastModified":"2026-06-17T02:20:38.787","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py."},{"lang":"es","value":"Los complementos Compassion Switzerland 10.01.4 para Odoo permiten la inyección SQL en models/partner_compassion.py."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:compassionuk:compassion_switzerland:10.01.4:*:*:*:*:odoo:*:*","matchCriteriaId":"C2E84738-4AFD-4252-A3BF-8A05FD0021D7"}]}]}],"references":[{"url":"https://github.com/CompassionCH/compassion-switzerland/pull/897","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/CompassionCH/compassion-switzerland/pull/897","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11780","sourceIdentifier":"security@odoo.com","published":"2019-12-19T16:16:42.370","lastModified":"2026-06-17T02:13:37.823","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation."},{"lang":"es","value":"Un control de acceso inapropiado en el sistema de campos computarizados del framework de Odoo Community versión 13.0 y Odoo Enterprise versión 13.0, permite a atacantes autenticados remotos acceder a información confidencial por medio de peticiones RPC diseñadas, lo que podría conllevar a una escalada de privilegios."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"13.0","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:13.0:*:*:*:community:*:*:*","matchCriteriaId":"4CE8B4A3-0EA3-4813-A511-16FB7D2B06AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:13.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"FDDB70FB-2B58-42B4-96CB-D8C8C152A6A7"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/42196","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/42196","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15632","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:12.487","lastModified":"2026-06-17T01:42:51.587","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials."},{"lang":"es","value":"Una comprobación de entrada inapropiada en la lógica de creación de la base de datos en Odoo Community versiones 11.0 y anteriores y Odoo Enterprise versiones 11.0 y anteriores, permite a atacantes remotos inicializar una base de datos vacía en la que pueden conectarse con las credenciales predeterminadas"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"11.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"11.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:C","baseScore":8.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":7.8,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"11.0","matchCriteriaId":"D9126A1A-FA35-4127-91B3-A3FA8B26FABB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"11.0","matchCriteriaId":"9ACA123F-EF25-4E9D-8D60-4368B2F25FA0"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63700","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63700","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15633","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:12.690","lastModified":"2026-06-17T01:42:51.727","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in \"document\" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames."},{"lang":"es","value":"Un problema de tipo cross-site scripting (XSS) en el módulo \"document\" en Odoo Community versiones 11.0 y anteriores y Odoo Enterprise versiones 11.0 y anteriores, permite a atacantes remotos inyectar un script web arbitrario en el navegador de una víctima por medio de nombres de archivo adjuntos diseñados"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"11.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"11.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"11.0","matchCriteriaId":"D9126A1A-FA35-4127-91B3-A3FA8B26FABB"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"11.0","matchCriteriaId":"9ACA123F-EF25-4E9D-8D60-4368B2F25FA0"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63701","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63701","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15634","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:12.783","lastModified":"2026-06-17T01:42:51.853","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link."},{"lang":"es","value":"Un problema de tipo cross-site scripting (XSS) en la gestión de archivos adjuntos en Odoo Community versiones 14.0 y anteriores y Odoo Enterprise versiones 14.0 y anteriores, permite a atacantes remotos inyectar un script web arbitrario en el navegador de una víctima por medio de un enlace diseñado"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"2DBCA075-326A-4F0F-89B9-1437744D0FFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"70406DFC-3BE1-46D3-BDDA-47D2156733D9"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63702","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63702","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15638","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:12.847","lastModified":"2026-06-17T01:42:52.130","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names."},{"lang":"es","value":"Un problema de tipo cross-site scripting (XSS) en el módulo mail en Odoo Community versiones 13.0 y anteriores y Odoo Enterprise versiones 13.0 y anteriores, permite a atacantes remotos inyectar un script web arbitrario en el navegador de una víctima por medio de nombres de canales diseñados"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"97EB1578-CFCC-4301-AEE7-DBBC6A92BC25"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"3451E55A-C240-40BF-AA17-E11DC5A56002"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63703","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63703","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15641","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:12.940","lastModified":"2026-06-17T01:42:52.397","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes."},{"lang":"es","value":"Un problema de tipo cross-site scripting (XSS) en el módulo web en Odoo Community versiones 11.0 hasta 14.0 y Odoo Enterprise versiones 11.0 hasta 14.0, permite a usuarios internos autenticados remotos inyectar un script web arbitrario en el navegador de una víctima por medio de atributos de eventos de calendario diseñados"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"11.0","lessThan":"unspecified","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"11.0","lessThan":"unspecified","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":4.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionStartIncluding":"11.0","versionEndIncluding":"14.0","matchCriteriaId":"4ED3084D-DF4C-486F-A161-ADCC24FF61F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"11.0","versionEndIncluding":"14.0","matchCriteriaId":"EBE9D00C-0BB2-4086-B6E3-C5AEC39070C1"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63704","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63704","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-15645","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.033","lastModified":"2026-06-17T01:42:52.580","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation."},{"lang":"es","value":"Un control de acceso inapropiado en el enrutamiento de mensajes en Odoo Community versiones 12.0 y anteriores y Odoo Enterprise versiones 12.0 y anteriores, permite a usuarios autenticados remotos crear registros arbitrarios por medio de cargas útiles diseñadas, lo que puede permitir una escalada de privilegios"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"A958BCBB-C656-44A5-A9A9-66A66AEA67A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"059733D6-977F-4731-BA24-36F6F50F76AB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63705","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63705","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11781","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.127","lastModified":"2026-06-17T02:13:37.943","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation."},{"lang":"es","value":"Una comprobación de entrada inapropiada en el componente portal en Odoo Community versiones 12.0 y anteriores y Odoo Enterprise versiones 12.0 y anteriores, permite a atacantes remotos engañar a unas víctimas para que modifiquen su cuenta por medio de enlaces diseñados, conllevando a una escalada de privilegios"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"12.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"A958BCBB-C656-44A5-A9A9-66A66AEA67A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"12.0","matchCriteriaId":"059733D6-977F-4731-BA24-36F6F50F76AB"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63706","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63706","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11782","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.190","lastModified":"2026-06-17T02:13:38.063","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation."},{"lang":"es","value":"Un control de acceso inapropiado en Odoo Community versiones 14.0 y anteriores y Odoo Enterprise versiones 14.0 y anteriores, permite a usuarios autenticados remotos con acceso a la administración de contactos modificar unas cuentas de usuario, conllevando a una escalada de privilegios"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"2DBCA075-326A-4F0F-89B9-1437744D0FFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"70406DFC-3BE1-46D3-BDDA-47D2156733D9"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63707","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63707","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11783","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.267","lastModified":"2026-06-17T02:13:38.180","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to subscribe to arbitrary mail channels uninvited."},{"lang":"es","value":"Un control de acceso inapropiado en el módulo mail (channel partners) en Odoo Community 14.0 y anteriores y Odoo Enterprise 14.0 y anteriores, permite que los usuarios autenticados remotos se suscriban a canales de correo arbitrarios no invitados"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"2DBCA075-326A-4F0F-89B9-1437744D0FFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"70406DFC-3BE1-46D3-BDDA-47D2156733D9"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63708","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63708","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11784","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.330","lastModified":"2026-06-17T02:13:38.310","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to."},{"lang":"es","value":"Un control de acceso inapropiado en el módulo mail (notifications) en Odoo Community versiones 14.0 y anteriores y Odoo Enterprise versiones 14.0 y anteriores, permite a usuarios autenticados remotos conseguir acceso a mensajes arbitrarios en conversaciones en las que no eran parte"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"2DBCA075-326A-4F0F-89B9-1437744D0FFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"14.0","matchCriteriaId":"70406DFC-3BE1-46D3-BDDA-47D2156733D9"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63709","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63709","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11785","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.393","lastModified":"2026-06-17T02:13:38.427","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages."},{"lang":"es","value":"Un control de acceso inapropiado en el módulo mail (followers) en Odoo Community versiones 13.0 y anteriores y Odoo Enterprise versiones 13.0 y anteriores, permite a usuarios autenticados remotos obtener acceso a unos mensajes publicados en registros de empresas a los que no se les dio acceso, y suscribirse para recibir futuros mensajes"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"97EB1578-CFCC-4301-AEE7-DBBC6A92BC25"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"3451E55A-C240-40BF-AA17-E11DC5A56002"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63710","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63710","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11786","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.457","lastModified":"2026-06-17T02:13:38.543","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify translated terms, which may lead to arbitrary content modification on translatable elements."},{"lang":"es","value":"Un control de acceso inapropiado en Odoo Community versiones 13.0 y anteriores y Odoo Enterprise versiones 13.0 y anteriores, permite a usuarios autenticados remotos modificar unos términos traducidos, lo que puede conllevar a modificaciones arbitrarias del contenido de unos elementos traducibles"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"97EB1578-CFCC-4301-AEE7-DBBC6A92BC25"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"3451E55A-C240-40BF-AA17-E11DC5A56002"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63711","source":"security@odoo.com","tags":["Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63711","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-29396","sourceIdentifier":"security@odoo.com","published":"2020-12-22T17:15:13.550","lastModified":"2026-06-17T03:11:16.103","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation."},{"lang":"es","value":"Un problema del sandboxing en Odoo Community versiones 11.0 hasta 13.0 y Odoo Enterprise versiones 11.0 hasta 13.0, cuando se ejecuta con Python versiones 3.6 o posteriores, permite a usuarios autenticados remotos ejecutar código arbitrario, conllevando a una escalada de privilegios"}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"11.0","lessThan":"unspecified","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"11.0","lessThan":"unspecified","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","lessThanOrEqual":"13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-267"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionStartIncluding":"11.0","versionEndIncluding":"13.0","matchCriteriaId":"C1269963-1DD6-4B28-A33F-B8C2F69AEF4C"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"11.0","versionEndIncluding":"13.0","matchCriteriaId":"1483CFE3-394B-4AB7-9561-63935D090B8D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6.0","matchCriteriaId":"DC3B293C-2E49-4EB8-8951-11BE3927C23D"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63712","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","source":"security@odoo.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/odoo/odoo/issues/63712","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-23166","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.140","lastModified":"2026-06-17T03:38:22.027","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-03T17:16:56.975334Z","id":"CVE-2021-23166","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-267"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107687","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107687","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-23176","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.220","lastModified":"2026-06-17T03:38:23.063","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T15:55:28.408420Z","id":"CVE-2021-23176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107682","source":"security@odoo.com","tags":["Issue Tracking","Mitigation","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107682","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Mitigation","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-23178","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.283","lastModified":"2026-06-17T03:38:23.290","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"odoo","product":"odoo_community","defaultStatus":"unknown","cpes":["cpe:2.3:a:odoo:odoo_community:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"custom","status":"affected"}]},{"vendor":"odoo","product":"odoo_enterprise","defaultStatus":"unknown","cpes":["cpe:2.3:a:odoo:odoo_enterprise:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T13:46:25.204237Z","id":"CVE-2021-23178","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107690","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107690","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-23186","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.340","lastModified":"2026-06-17T03:38:23.817","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tenants, in a multi-tenant system."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"odoo","product":"odoo_community","defaultStatus":"unknown","cpes":["cpe:2.3:a:odoo:odoo_community:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"odoo","product":"odoo_enterprise","defaultStatus":"unknown","cpes":["cpe:2.3:a:odoo:odoo_enterprise:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-17T20:54:45.816025Z","id":"CVE-2021-23186","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-267"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107688","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107688","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-23203","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.403","lastModified":"2026-06-17T03:38:25.127","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"14.0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"14.0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-03T17:13:00.406283Z","id":"CVE-2021-23203","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:14.0:*:*:*:community:*:*:*","matchCriteriaId":"4D952E47-04E1-4146-A3AA-3804A1AB52DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:14.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"BEB5354F-C1AC-48D6-8922-656F952442A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:15.0:*:*:*:community:*:*:*","matchCriteriaId":"EBD0BABD-16C5-449D-8BE7-9E948A509FA5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:15.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"24A23452-4857-4F4B-AA5A-944F9073A554"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107695","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107695","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-26263","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.470","lastModified":"2026-06-17T03:43:01.690","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"14.0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"14.0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"odoo","product":"odoo_community","defaultStatus":"unaffected","cpes":["cpe:2.3:a:odoo:odoo_community:14.0:*:*:*:*:*:*:*"],"versions":[{"version":"14.0","lessThanOrEqual":"15.0","versionType":"custom","status":"affected"}]},{"vendor":"odoo","product":"odoo_enterprise","defaultStatus":"unaffected","cpes":["cpe:2.3:a:odoo:odoo_enterprise:14.0:*:*:*:*:*:*:*"],"versions":[{"version":"14.0","lessThanOrEqual":"15.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T14:49:47.368802Z","id":"CVE-2021-26263","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:14.0:*:*:*:community:*:*:*","matchCriteriaId":"4D952E47-04E1-4146-A3AA-3804A1AB52DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:14.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"BEB5354F-C1AC-48D6-8922-656F952442A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:15.0:*:*:*:community:*:*:*","matchCriteriaId":"EBD0BABD-16C5-449D-8BE7-9E948A509FA5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:15.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"24A23452-4857-4F4B-AA5A-944F9073A554"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107693","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107693","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-26947","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.530","lastModified":"2026-06-17T03:44:03.393","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T15:39:58.913170Z","id":"CVE-2021-26947","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107694","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107694","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-44460","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.600","lastModified":"2026-06-17T04:12:22.727","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"13.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"13.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T13:23:44.267561Z","id":"CVE-2021-44460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"97EB1578-CFCC-4301-AEE7-DBBC6A92BC25"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"3451E55A-C240-40BF-AA17-E11DC5A56002"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107685","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://github.com/odoo/odoo/issues/107685","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-44461","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.670","lastModified":"2026-06-17T04:12:22.840","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"13.0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T14:56:19.460796Z","id":"CVE-2021-44461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"13.0","versionEndIncluding":"15.0","matchCriteriaId":"D3FA7C86-7FC1-4310-9945-EE9265577C5D"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107686","source":"security@odoo.com","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/odoo/odoo/issues/107686","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-44465","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.727","lastModified":"2026-06-17T04:12:23.320","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"13.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"13.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-03T17:15:33.343989Z","id":"CVE-2021-44465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"97EB1578-CFCC-4301-AEE7-DBBC6A92BC25"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"13.0","matchCriteriaId":"3451E55A-C240-40BF-AA17-E11DC5A56002"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107692","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://github.com/odoo/odoo/issues/107692","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-44476","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.783","lastModified":"2026-06-17T04:12:23.940","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-03T19:33:46.207981Z","id":"CVE-2021-44476","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-267"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107684","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107684","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-44547","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.843","lastModified":"2026-06-17T04:12:33.077","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T16:25:59.608086Z","id":"CVE-2021-44547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-267"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107696","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://github.com/odoo/odoo/issues/107696","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-44775","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.903","lastModified":"2026-06-17T04:12:50.293","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-15T13:57:10.321947Z","id":"CVE-2021-44775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107691","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107691","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-45071","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:09.963","lastModified":"2026-06-17T04:13:07.837","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-17T20:57:21.835919Z","id":"CVE-2021-45071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107697","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107697","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2021-45111","sourceIdentifier":"security@odoo.com","published":"2023-04-25T19:15:10.020","lastModified":"2026-06-17T04:13:11.440","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV30":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-16T13:41:04.565422Z","id":"CVE-2021-45111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"C5B912BD-1FB4-418A-9CE3-FBE0903D70BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"15.0","matchCriteriaId":"2BFAF5BD-20F9-402C-B7EB-4E0294A572AE"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107683","source":"security@odoo.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107683","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2023-48050","sourceIdentifier":"cve@mitre.org","published":"2023-12-15T01:15:08.093","lastModified":"2026-06-17T06:33:34.293","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py component."},{"lang":"es","value":"Vulnerabilidad de inyección SQL en Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (también conocido como odoo-biometric-attendance) v. 13.0 a 16.0.1 permite a un atacante remoto ejecutar código arbitrario y obtener privilegios a través del parámetro db en el componente controllers/controllers.py."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:camsbiometrics:zkteco\\,_essl\\,_cams_biometrics_integration_module:*:*:*:*:*:*:*:*","versionStartIncluding":"13.0","versionEndIncluding":"16.0.1","matchCriteriaId":"D19187DF-F113-433C-8313-398E94085F89"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:biometric_attendance:*:*:*:*:*:*:*:*","versionStartIncluding":"13.0","versionEndIncluding":"16.0.1","matchCriteriaId":"76C86D2C-5B44-418A-8FB8-AB68BE0C7D14"}]}]}],"references":[{"url":"https://github.com/luvsn/OdZoo/tree/main/exploits/odoo-biometric-attendance","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/luvsn/OdZoo/tree/main/exploits/odoo-biometric-attendance","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-56299","sourceIdentifier":"audit@patchstack.com","published":"2025-01-07T11:15:12.960","lastModified":"2026-06-17T08:12:00.513","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pektsekye Notify Odoo notify-odoo allows Stored XSS.This issue affects Notify Odoo: from n/a through <= 1.0.0."},{"lang":"es","value":"La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Pektsekye Notify Odoo permite XSS almacenado. Este problema afecta a Notify Odoo: desde n/a hasta 1.0.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Pektsekye","product":"Notify Odoo","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"notify-odoo","versions":[{"version":"0","lessThanOrEqual":"1.0.0","versionType":"custom","status":"affected","changes":[{"at":"1.0.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-07T15:50:52.780942Z","id":"CVE-2024-56299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/notify-odoo/vulnerability/wordpress-notify-odoo-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2024-12368","sourceIdentifier":"security@odoo.com","published":"2025-02-25T18:15:27.020","lastModified":"2026-06-17T06:59:35.310","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users."},{"lang":"es","value":"El control de acceso inadecuado en el módulo auth_oauth de Odoo Community 15.0 y Odoo Enterprise 15.0 permite que un usuario interno exporte los tokens OAuth de otros usuarios."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-25T18:59:24.643196Z","id":"CVE-2024-12368","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:15.0:*:*:*:community:*:*:*","matchCriteriaId":"EBD0BABD-16C5-449D-8BE7-9E948A509FA5"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:15.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"24A23452-4857-4F4B-AA5A-944F9073A554"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/193854","source":"security@odoo.com","tags":["Exploit","Issue Tracking","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-36259","sourceIdentifier":"security@odoo.com","published":"2025-02-25T19:15:14.343","lastModified":"2026-06-17T07:36:23.450","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack."},{"lang":"es","value":"Un control de acceso inadecuado en el módulo de correo de Odoo Community 17.0 y Odoo Enterprise 17.0 permite a atacantes autenticados remotos extraer información confidencial a través de un ataque manipulado basado en oráculo (respuesta sí/no)."}],"affected":[{"source":"security@odoo.com","affectedData":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"master","lessThanOrEqual":"17.0","versionType":"semver","status":"affected"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"master","lessThanOrEqual":"17.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@odoo.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-25T19:39:08.861853Z","id":"CVE-2024-36259","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@odoo.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:17.0:*:*:*:community:*:*:*","matchCriteriaId":"1FF25CC4-AE0E-4F96-8708-83512BD0E249"},{"vulnerable":true,"criteria":"cpe:2.3:a:odoo:odoo:17.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1BD12AD5-9461-4AEC-A06D-0300CE27A0C1"}]}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/199330","source":"security@odoo.com","tags":["Exploit","Mitigation","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-30620","sourceIdentifier":"audit@patchstack.com","published":"2025-03-24T14:15:34.520","lastModified":"2026-06-17T09:09:02.893","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form Integrator: from n/a through <= 1.1.0."},{"lang":"es","value":"La vulnerabilidad de Cross-Site Request Forgery (CSRF) en coderscom WP Odoo Form Integrator permite XSS almacenado. Este problema afecta al Integrador de formularios de WP Odoo desde la versión n/d hasta la 1.1.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"coderscom","product":"WP Odoo Form Integrator","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-odoo-form-integrator","versions":[{"version":"0","lessThanOrEqual":"1.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-24T21:21:16.815290Z","id":"CVE-2025-30620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/wp-odoo-form-integrator/vulnerability/wordpress-wp-odoo-form-integrator-plugin-1-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-25137","sourceIdentifier":"security-advisories@github.com","published":"2026-02-02T23:16:09.280","lastModified":"2026-06-17T10:24:10.317","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05."},{"lang":"es","value":"El paquete NixOs Odoo es un sistema ERP y CRM de código abierto. Desde la versión 21.11 hasta antes de la 25.11 y la 26.05, cada configuración de Odoo basada en NixOS expone públicamente el gestor de la base de datos sin ninguna autenticación. Esto permite a actores no autorizados eliminar y descargar la base de datos completa, incluyendo el almacén de archivos de Odoo. El acceso no autorizado es evidente a partir de las solicitudes HTTP. Si se mantienen, la búsqueda en los registros de acceso y/o el registro de Odoo de solicitudes a /web/database puede dar indicadores, si esto ha sido explotado activamente. El gestor de la base de datos es una característica destinada al desarrollo y no está pensado para ser accesible públicamente. En otras configuraciones, una contraseña maestra actúa como segunda línea de defensa. Sin embargo, debido a la naturaleza de NixOS, Odoo no puede modificar su propio archivo de configuración y, por lo tanto, no puede persistir la contraseña autogenerada. Esto también se aplica al establecer manualmente una contraseña maestra en la interfaz de usuario web (web-UI). Esto significa que la contraseña se pierde al reiniciar Odoo. Cuando no se establece ninguna contraseña, se le pide al usuario que establezca una directamente a través del gestor de la base de datos. Esto no requiere autenticación ni acción por parte de ningún usuario autorizado o del administrador del sistema. Por lo tanto, la base de datos es efectivamente legible por cualquier persona capaz de alcanzar Odoo. Esta vulnerabilidad está corregida en las versiones 25.11 y 26.05."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"NixOS","product":"nixpkgs","versions":[{"version":">= 21.11, < 25.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-04T15:55:17.650303Z","id":"CVE-2026-25137","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://github.com/NixOS/nixpkgs/pull/485310","source":"security-advisories@github.com"},{"url":"https://github.com/NixOS/nixpkgs/pull/485454","source":"security-advisories@github.com"},{"url":"https://github.com/NixOS/nixpkgs/security/advisories/GHSA-cwmq-6wv5-f3px","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-8425","sourceIdentifier":"security@wordfence.com","published":"2026-05-15T09:16:17.807","lastModified":"2026-06-17T11:03:55.533","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the _updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to an attacker-controlled URL and modify notification, tracking image, and allowed IP address settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"pektsekye","product":"Notify Odoo","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-15T13:15:21.340056Z","id":"CVE-2026-8425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/notify-odoo/tags/1.0.1/Controller/Adminhtml/No/Settings.php#L46","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/notify-odoo/tags/1.0.1/Controller/Adminhtml/No/Settings.php#L9","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/notify-odoo/tags/1.0.1/view/adminhtml/templates/no/settings.php#L54","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/notify-odoo/trunk/Controller/Adminhtml/No/Settings.php#L46","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/notify-odoo/trunk/Controller/Adminhtml/No/Settings.php#L9","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/notify-odoo/trunk/view/adminhtml/templates/no/settings.php#L54","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3531377%40notify-odoo&new=3531377%40notify-odoo&sfp_email=&sfph_mail=","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccaba382-7fe8-4197-bec4-87c35d9a7a81?source=cve","source":"security@wordfence.com"}]}}]}