Sandboxing Issue in Odoo Products by Odoo
CVE-2020-29396

9.9CRITICAL

Key Information:

Vendor

Odoo

Status
Odoo Community
Odoo Enterprise
Vendor
CVE Published:
22 December 2020

What is CVE-2020-29396?

A significant sandboxing issue affects Odoo Community and Enterprise versions 11.0 to 13.0, when operating with Python 3.6 or later. This vulnerability allows remote authenticated users to execute arbitrary code, which could lead to privilege escalation, thereby compromising the integrity and security of the Odoo environment. Users are advised to address this vulnerability promptly to mitigate potential risk.

Affected Version(s)

Odoo Community 11.0

Odoo Community <= 13.0

Odoo Enterprise 11.0

References

https://github.com/odoo/odoo/issues/63712
x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Toufik Ben Jaa
Stéphane Debauche
Benoît FONTAINE
.