PT-2017-11514 · Odoo · Odoo+2

Ayrx · Publicado 2017-07-04 · Atualizado 2019-10-03 · CVE-2017-10803

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Odoo versions 8.0, 9.0, and 10.0 Odoo Community Edition versions 9.0 and 10.0 Odoo Enterprise Edition versions 9.0 and 10.0

Description The issue arises from insecure handling of anonymization data in the Database Anonymization module, allowing remote authenticated privileged users to execute arbitrary Python code due to the use of unpickle.

Recommendations For Odoo version 8.0, update to a version that includes a fix for the insecure handling of anonymization data. For Odoo Community Edition versions 9.0 and 10.0, update to a version that includes a fix for the insecure handling of anonymization data. For Odoo Enterprise Edition versions 9.0 and 10.0, update to a version that includes a fix for the insecure handling of anonymization data. As a temporary workaround, consider disabling the Database Anonymization module until a patch is available.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-10803

Produtos afetados

Odoo

Odoo Community Edition

Odoo Enterprise Edition

Referências · 4

• 🔥 https://exploit-db.com/exploits/44064 · Exploit
• https://github.com/odoo/odoo/issues/17898 · Correção
• https://osv.dev/vulnerability/CVE-2017-10803 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-10803 · Nota de Segurança