Code Execution Vulnerability in Odoo Community and Enterprise Products
CVE-2018-14860

9.1CRITICAL

Key Information:

Vendor

Odoo

Status
Odoo
Vendor
CVE Published:
3 July 2019

What is CVE-2018-14860?

The vulnerability arises from improper sanitization of dynamic user expressions in Odoo Community and Enterprise versions 11.0 and earlier. This flaw enables authenticated privileged users to bypass the restrictions of the dynamic expression sandbox, leading to the execution of arbitrary code on the server. As a result, this can compromise the integrity and security of the underlying system.

References

https://github.com/odoo/odoo/issues/32505
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.