Cross-Site Scripting Vulnerability in Odoo Discuss App across Versions
CVE-2021-26263

7.5HIGH

Key Information:

Vendor

Odoo

Status
Odoo Community
Odoo Enterprise
Vendor
CVE Published:
25 April 2023

What is CVE-2021-26263?

The Discuss app in Odoo Community and Enterprise versions 14.0 through 15.0 is vulnerable to a cross-site scripting (XSS) flaw. This vulnerability allows remote attackers to inject arbitrary web scripts into the browser of unsuspecting users by posting specially crafted content. Successful exploitation can lead to unauthorized access and manipulation of sensitive user data, posing a significant risk to the integrity of web applications and associated user sessions.

Affected Version(s)

Odoo Community 14.0 <= 15.0

Odoo Enterprise 14.0 <= 15.0

References

https://github.com/odoo/odoo/issues/107693
https://www.debian.org/security/2023/dsa-5399

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Theodoros Malachias
iamsushi
Ranjit Pahan
.
CVE-2021-26263 : Cross-Site Scripting Vulnerability in Odoo Discuss App across Versions