CVE-2018-14867

Published: Jun 28, 2019Modified: Nov 21, 2024

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.

Affected (4)

Products: Odoo: Odoo

Odoo

1 product

Odoo

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Odoo Odoo	Version 10.0
Odoo Odoo	Version 10.0
Odoo Odoo	Version 9.0
Odoo Odoo	Version 9.0

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://github.com/odoo/odoo/commits/master

Source: cve@mitre.org

Third Party Advisory

https://github.com/odoo/odoo/issues/32503

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/odoo/odoo/commits/master

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/odoo/odoo/issues/32503

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.