PT-2017-11514 · Odoo · Odoo+2

Ayrx · Published 2017-07-04 · Updated 2019-10-03 · CVE-2017-10803

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Odoo versions 8.0, 9.0, and 10.0 Odoo Community Edition versions 9.0 and 10.0 Odoo Enterprise Edition versions 9.0 and 10.0

Description The issue arises from insecure handling of anonymization data in the Database Anonymization module, allowing remote authenticated privileged users to execute arbitrary Python code due to the use of unpickle.

Recommendations For Odoo version 8.0, update to a version that includes a fix for the insecure handling of anonymization data. For Odoo Community Edition versions 9.0 and 10.0, update to a version that includes a fix for the insecure handling of anonymization data. For Odoo Enterprise Edition versions 9.0 and 10.0, update to a version that includes a fix for the insecure handling of anonymization data. As a temporary workaround, consider disabling the Database Anonymization module until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-10803

Affected Products

Odoo

Odoo Community Edition

Odoo Enterprise Edition

References · 4

• 🔥 https://exploit-db.com/exploits/44064 · Exploit
• https://github.com/odoo/odoo/issues/17898 · Patch
• https://osv.dev/vulnerability/CVE-2017-10803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10803 · Security Note