PT-2019-9066 · Odoo · Odoo Community+1

Nils Hamerlinck · Published 2019-06-28 · Updated 2020-08-24 · CVE-2018-14868

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Odoo Community version 9.0 Odoo Enterprise version 9.0

Description The issue is related to incorrect access control in the Password Encryption module, allowing authenticated users to change the password of other users without knowing their current password via a crafted RPC call.

Recommendations For Odoo Community version 9.0, update the Password Encryption module to enforce proper access control. For Odoo Enterprise version 9.0, update the Password Encryption module to enforce proper access control. As a temporary workaround, consider restricting access to the Password Encryption module until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-14868

Affected Products

Odoo Community

Odoo Enterprise

References · 5

• https://github.com/odoo/odoo/issues/32507 · Patch
• https://osv.dev/vulnerability/CVE-2018-14868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14868 · Security Note
• https://github.com/odoo/odoo/commits/master · Note
• https://t.me/cibsecurity/5219 · Telegram Post