PT-2023-12546 · Odoo+1 · Odoo Enterprise+1

Published 2023-04-25 · Updated 2024-07-15 · CVE-2021-44461

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Odoo Enterprise versions 13.0 through 15.0

Description The issue is a cross-site scripting (XSS) problem in the Accounting app, allowing remote attackers who can control the contents of accounting journal entries to inject arbitrary web script in a victim's browser. This can occur when an attacker manipulates the data in the accounting journal entries, which then executes in the victim's browser, potentially leading to unauthorized actions or data theft.

Recommendations For Odoo Enterprise versions 13.0 through 15.0, update to a version that includes a fix for this issue, as using an outdated version leaves the system open to XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-6595

BIT-ODOO-2021-44461

CVE-2021-44461

Affected Products

Alt Linux

Odoo Enterprise

References · 6

• https://github.com/odoo/odoo/issues/107686 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-odoo-2021-44461 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44461 · Security Note
• https://t.me/cvenotify/86172 · Telegram Post
• https://t.me/cvenotify/49054 · Telegram Post