Improper Access Control in Odoo Reporting Engine
CVE-2021-23203

7.5HIGH

Key Information:

Vendor

Odoo

Status
Odoo Community
Odoo Enterprise
Vendor
CVE Published:
25 April 2023

What is CVE-2021-23203?

The reporting engine in Odoo Community versions 14.0 and 15.0, as well as Odoo Enterprise versions 14.0 and 15.0, is susceptible to a flaw that allows unauthorized remote attackers to manipulate crafted requests and gain access to PDF reports for various documents. This vulnerability poses significant risks by potentially exposing sensitive information to malicious actors.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Odoo Community 14.0 <= 15.0

Odoo Enterprise 14.0 <= 15.0

References

https://github.com/odoo/odoo/issues/107695
https://www.debian.org/security/2023/dsa-5399

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tiffany Chang
iamsushi
Ranjit Pahan
Iago Ruiz
JSON
.