PT-2019-9061 · Odoo+1 · Odoo Community+2

Nils Hamerlinck · Published 2019-04-26 · Updated 2019-07-05 · CVE-2018-14863

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Odoo Community versions 8.0 through 11.0 Odoo Enterprise versions 9.0 through 11.0

Description The issue is related to incorrect access control in the RPC framework, allowing authenticated users to call private functions via RPC.

Recommendations For Odoo Community versions 8.0 through 11.0, update to a version that includes the fix for the incorrect access control issue. For Odoo Enterprise versions 9.0 through 11.0, update to a version that includes the fix for the incorrect access control issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2019-1740

CVE-2018-14863

Affected Products

Alt Linux

Odoo Community

Odoo Enterprise

References · 5

• https://github.com/odoo/odoo/issues/32508 · Patch
• https://osv.dev/vulnerability/CVE-2018-14863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14863 · Security Note
• https://t.me/cvenotify/180 · Telegram Post
• https://t.me/cvenotify/236 · Telegram Post