PT-2019-9070 · Odoo+1 · Odoo Community+2

Stephane Bidoul · Publicado 2019-04-26 · Atualizado 2020-08-24 · CVE-2018-14886

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Odoo Community versions 11.0 and earlier Odoo Enterprise versions 11.0 and earlier

Description The issue concerns the module-description renderer, which fails to disable RST's local file inclusion. This allows privileged authenticated users to read local files by crafting a module description.

Recommendations For Odoo Community versions 11.0 and earlier, update to a version that fixes this issue. For Odoo Enterprise versions 11.0 and earlier, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the module-description renderer to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

ALT-PU-2019-1740

CVE-2018-14886

Produtos afetados

Alt Linux

Odoo Community

Odoo Enterprise

Referências · 5

• https://github.com/odoo/odoo/issues/32513 · Correção
• https://github.com/odoo/odoo/commits/master · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14886 · Nota de Segurança
• https://t.me/cibsecurity/5217 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-14886 · Aviso do Fabricante