Nils Hamerlinck

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions prior to 15.0 Odoo Enterprise versions prior to 15.0 **Description** The issue is related to improper access control, allowing remote authenticated users to trigger the creation of demonstration data. This includes user accounts with known credentials. **Recommendations** For Odoo Community versions prior to 15.0, update to a version later than 15.0 to resolve the issue. For Odoo Enterprise versions prior to 15.0, update to a version later than 15.0 to resolve the issue. As a temporary workaround, consider restricting access to demonstration data creation functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier **Description** The issue allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link. This is a cross-site scripting (XSS) issue. **Recommendations** For Odoo Community versions 15.0 and earlier, update to a version later than 15.0 to resolve the issue. For Odoo Enterprise versions 15.0 and earlier, update to a version later than 15.0 to resolve the issue. As a temporary workaround, consider restricting access to crafted links to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier **Description** A sandboxing issue allows authenticated administrators to access and modify database contents of other tenants in a multi-tenant system. **Recommendations** For Odoo Community versions 15.0 and earlier, update to a version later than 15.0 to resolve the issue. For Odoo Enterprise versions 15.0 and earlier, update to a version later than 15.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database contents to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier **Description** A sandboxing issue allows authenticated administrators to read and write local files on the server. **Recommendations** For Odoo Community versions 15.0 and earlier, update to a version later than 15.0 to resolve the issue. For Odoo Enterprise versions 15.0 and earlier, update to a version later than 15.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive local files on the server until a patch is available.

**Nome do software vulnerável e versões afetadas** Versões 14.0 e anteriores do Odoo Community Versões 14.0 e anteriores do Odoo Enterprise **Descrição** O problema está relacionado a um controle de acesso inadequado no módulo de e-mail, afetando especificamente os parceiros de canal. Isso permite que usuários remotos autenticados se inscrevam em canais de e-mail arbitrários sem um convite. **Recomendações** Para as versões 14.0 e anteriores do Odoo Community, atualize para uma versão posterior à 14.0 para resolver o problema. Para as versões 14.0 e anteriores do Odoo Enterprise, atualize para uma versão posterior à 14.0 para resolver o problema. Como solução temporária, considere restringir o acesso ao módulo de e-mail para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas: Versões 12.0 e anteriores do Odoo Community Versões 12.0 e anteriores do Odoo Enterprise Descrição: O problema está relacionado a um controle de acesso inadequado no roteamento de mensagens, permitindo que usuários remotos autenticados criem registros arbitrários por meio de cargas maliciosas. Isso pode levar à escalada de privilégios. Recomendações: Para as versões 12.0 e anteriores do Odoo Community, atualize para uma versão que inclua os patches de segurança necessários para corrigir o problema de controle de acesso inadequado. Para as versões 12.0 e anteriores do Odoo Enterprise, atualize para uma versão que inclua os patches de segurança necessários para corrigir o problema de controle de acesso inadequado. Como solução temporária, considere restringir o acesso à funcionalidade de roteamento de mensagens para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Odoo Community versões 13.0 e anteriores Odoo Enterprise versões 13.0 e anteriores **Descrição** O problema está relacionado a um controle de acesso inadequado no módulo de e-mail (seguidores) do Odoo Community e do Odoo Enterprise. Isso permite que usuários autenticados remotamente obtenham acesso a mensagens postadas em registros comerciais aos quais não tinham acesso e se inscrevam para receber mensagens futuras. **Recomendações** Para as versões 13.0 e anteriores do Odoo Community, atualize para uma versão posterior à 13.0 para resolver o problema. Para as versões 13.0 e anteriores do Odoo Enterprise, atualize para uma versão posterior à 13.0 para resolver o problema. Como solução temporária, considere restringir o acesso ao módulo de e-mail (seguidores) para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 9.0 through 11.0 Odoo Enterprise versions 9.0 through 11.0 **Description** The issue is related to incorrect access control in asset bundles, allowing remote authenticated users to inject arbitrary web script via a crafted attachment. **Recommendations** For Odoo Community versions 9.0 through 11.0, update to a version that includes the fix for this issue. For Odoo Enterprise versions 9.0 through 11.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to attachment uploads to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Odoo Community version 9.0 Odoo Enterprise version 9.0 **Description** The issue is related to incorrect access control in the Password Encryption module, allowing authenticated users to change the password of other users without knowing their current password via a crafted RPC call. **Recommendations** For Odoo Community version 9.0, update the Password Encryption module to enforce proper access control. For Odoo Enterprise version 9.0, update the Password Encryption module to enforce proper access control. As a temporary workaround, consider restricting access to the Password Encryption module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 9.0 through 10.0 Odoo Enterprise versions 9.0 through 10.0 **Description** The issue is related to incorrect access control in the portal messaging system, allowing remote attackers to post messages on behalf of customers and guess document attribute values via crafted parameters. **Recommendations** For Odoo Community versions 9.0 through 10.0, consider restricting access to the portal messaging system until a fix is available. For Odoo Enterprise versions 9.0 through 10.0, consider restricting access to the portal messaging system until a fix is available. As a temporary workaround, consider disabling the use of crafted parameters in the portal messaging system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Odoo versions 8.x through 11.x **Description** The issue concerns a ReDoS (regular expression denial of service) vulnerability in the dbfilter from header module provided by the Odoo Community Association (OCA). This vulnerability affects Odoo under certain circumstances. **Recommendations** For Odoo versions 8.x through 11.x, consider disabling the dbfilter from header module as a temporary workaround until a patch is available. Restrict access to potentially vulnerable modules to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 11.0 and earlier Odoo Enterprise versions 11.0 and earlier **Description** The issue is related to improper Host header sanitization in the dbfilter routing component. This allows a remote attacker to deny access to the service and disclose database names via a crafted request. **Recommendations** For Odoo Community versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue. For Odoo Enterprise versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue. As a temporary workaround, consider restricting access to the dbfilter routing component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 9.0 through 11.0 Odoo Enterprise versions 9.0 through 11.0 **Description** The report engine in Odoo does not use secure options when passing documents to wkhtmltopdf, allowing remote attackers to read local files. **Recommendations** For Odoo Community versions 9.0 through 11.0, consider updating to a version that uses secure options when passing documents to wkhtmltopdf. For Odoo Enterprise versions 9.0 through 11.0, consider updating to a version that uses secure options when passing documents to wkhtmltopdf. As a temporary workaround, consider restricting access to the report engine until a secure version is available.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 8.0 through 11.0 Odoo Enterprise versions 9.0 through 11.0 **Description** The issue is related to incorrect access control in the RPC framework, allowing authenticated users to call private functions via RPC. **Recommendations** For Odoo Community versions 8.0 through 11.0, update to a version that includes the fix for the incorrect access control issue. For Odoo Enterprise versions 9.0 through 11.0, update to a version that includes the fix for the incorrect access control issue.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 11.0 and earlier Odoo Enterprise versions 11.0 and earlier **Description** The issue is related to incorrect access control in the mail templating system, allowing authenticated internal users to delete arbitrary menu items via a crafted RPC request. **Recommendations** For Odoo Community versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue. For Odoo Enterprise versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 10.0 through 11.0 Odoo Enterprise versions 10.0 through 11.0 **Description** The issue is related to improper data access control, allowing authenticated users to export secure hashed passwords of other users via a CSV export. **Recommendations** For Odoo Community versions 10.0 through 11.0, update to a version that includes the necessary access control fixes to prevent unauthorized data exports. For Odoo Enterprise versions 10.0 through 11.0, apply the security patch that addresses the improper data access control to restrict authenticated users from accessing sensitive user data.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 11.0 and earlier Odoo Enterprise versions 11.0 and earlier **Description** The issue is related to incorrect access control in the password reset component, allowing authenticated users to reset the password of other users by being the first party to use the secure token. **Recommendations** For Odoo Community versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue. For Odoo Enterprise versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Odoo versions 8.0 through 10.0 **Description** The issue allows remote authenticated users to read arbitrary local files readable by the Odoo service due to a directory traversal vulnerability in `tools.file open`. **Recommendations** For Odoo versions 8.0 through 10.0, update to a version that contains a fix for this issue.