Swapnesh Shah

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 13.0 and earlier Odoo Enterprise versions 13.0 and earlier **Description** The issue allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system via crafted RPC requests. This is due to improper access control in the affected versions of Odoo Community and Odoo Enterprise. **Recommendations** For Odoo Community versions 13.0 and earlier, update to a version later than 13.0 to resolve the issue. For Odoo Enterprise versions 13.0 and earlier, update to a version later than 13.0 to resolve the issue. As a temporary workaround, consider restricting access to crafted RPC requests until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Odoo Community version 13.0 Odoo Enterprise version 13.0 **Description** The issue is related to improper access control in the computed fields system of the Odoo framework, allowing remote authenticated attackers to access sensitive information via crafted RPC requests. This could lead to privilege escalation. The vulnerability is also associated with errors in processing unsaved computed fields on behalf of the superuser, which can be exploited by a remote attacker to elevate their privileges in the target system by sending specially crafted RPC requests. **Recommendations** For Odoo Community version 13.0, update to a version that includes a fix for the improper access control issue in the computed fields system. For Odoo Enterprise version 13.0, update to a version that includes a fix for the improper access control issue in the computed fields system. As a temporary workaround, consider restricting access to the computed fields system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 11.0 and earlier Odoo Enterprise versions 11.0 and earlier **Description** The issue is related to incorrect access control in the password reset component, allowing authenticated users to reset the password of other users by being the first party to use the secure token. **Recommendations** For Odoo Community versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue. For Odoo Enterprise versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 10.0 through 11.0 Odoo Enterprise versions 10.0 through 11.0 **Description** The issue is related to improper data access control, allowing authenticated users to export secure hashed passwords of other users via a CSV export. **Recommendations** For Odoo Community versions 10.0 through 11.0, update to a version that includes the necessary access control fixes to prevent unauthorized data exports. For Odoo Enterprise versions 10.0 through 11.0, apply the security patch that addresses the improper data access control to restrict authenticated users from accessing sensitive user data.