PT-2019-9062 · Odoo · Odoo Community+1

Nils Hamerlinck · Published 2019-07-03 · Updated 2019-07-05 · CVE-2018-14864

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Odoo Community versions 9.0 through 11.0 Odoo Enterprise versions 9.0 through 11.0

Description The issue is related to incorrect access control in asset bundles, allowing remote authenticated users to inject arbitrary web script via a crafted attachment.

Recommendations For Odoo Community versions 9.0 through 11.0, update to a version that includes the fix for this issue. For Odoo Enterprise versions 9.0 through 11.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to attachment uploads to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2018-14864

Affected Products

Odoo Community

Odoo Enterprise

References · 5

• https://github.com/odoo/odoo/issues/32502 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-14864 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14864 · Vendor Advisory
• https://t.me/cvenotify/181 · Telegram Post
• https://t.me/cvenotify/237 · Telegram Post