CVE-2018-14886

Published: Jun 28, 2019Modified: Nov 21, 2024

4.9

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.

Affected (6)

Products: Odoo: Odoo

Odoo

1 product

Odoo

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Odoo Odoo	Version 10.0
Odoo Odoo	Version 10.0
Odoo Odoo	Version 11.0
Odoo Odoo	Version 11.0
Odoo Odoo	Version 9.0
Odoo Odoo	Version 9.0

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (4)

https://github.com/odoo/odoo/commits/master

Source: cve@mitre.org

Third Party Advisory

https://github.com/odoo/odoo/issues/32513

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/odoo/odoo/commits/master

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/odoo/odoo/issues/32513

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.