Overview
- Description
- Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
- Source
- security@odoo.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Severity
- MEDIUM
CVSS 3.0
- Type
- Secondary
- Base score
- 8.1
- Impact score
- 5.2
- Exploitability score
- 2.8
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 4
- Impact score
- 2.9
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:N/I:P/A:N
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A958BCBB-C656-44A5-A9A9-66A66AEA67A0",
"versionEndIncluding": "12.0"
},
{
"criteria": "cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "059733D6-977F-4731-BA24-36F6F50F76AB",
"versionEndIncluding": "12.0"
}
],
"operator": "OR"
}
]
}
]