PT-2020-8537 · Odoo+1 · Odoo Community+2

P. Valov · Published 2019-04-26 · Updated 2020-12-22 · CVE-2018-15632

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 11.0 and earlier Odoo Enterprise versions 11.0 and earlier

Description: The issue is related to improper input validation in database creation logic, allowing remote attackers to initialize an empty database and connect to it using default credentials.

Recommendations: For Odoo Community versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue. For Odoo Enterprise versions 11.0 and earlier, update to a version later than 11.0 to resolve the issue. As a temporary workaround, consider restricting access to the database creation logic to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-1740

CVE-2018-15632

Affected Products

Alt Linux

Odoo Community

Odoo Enterprise

References · 6

• https://github.com/odoo/odoo/issues/63700 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-15632 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15632 · Vendor Advisory
• https://t.me/cibsecurity/21174 · Telegram Post
• https://t.me/cvenotify/7546 · Telegram Post
• https://t.me/cvenotify/7582 · Telegram Post