PT-2023-12044 · Odoo+1 · Odoo Community+2

Florent Mirieu De La Barre

·

Publicado

2023-04-25

·

Atualizado

2024-07-15

·

CVE-2021-23176

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier
Description The issue is related to improper access control in the reporting engine of the l10n fr fec module. This allows remote authenticated users to extract accounting information via crafted RPC packets.
Recommendations For Odoo Community versions 15.0 and earlier, update to a version that includes the fix for this issue. For Odoo Enterprise versions 15.0 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the reporting engine of the l10n fr fec module to minimize the risk of exploitation.

Correção

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2023-6595
BIT-ODOO-2021-23176
CVE-2021-23176
DSA-5399-1

Produtos afetados

Alt Linux
Odoo Community
Odoo Enterprise