Improper Access Control in Odoo Community and Enterprise Versions
CVE-2021-44460

7.4HIGH

Key Information:

Vendor

Odoo

Status
Odoo Community
Odoo Enterprise
Vendor
CVE Published:
25 April 2023

What is CVE-2021-44460?

The vulnerability allows users with deactivated accounts to access the Odoo system using their previous permissions by crafting specific RPC requests. This improperly managed access control can lead to unauthorized data exposure and manipulation, posing significant risks to the integrity and confidentiality of the platform's data.

Affected Version(s)

Odoo Community 0 <= 13.0

Odoo Enterprise 0 <= 13.0

References

https://github.com/odoo/odoo/issues/107685

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Xavier Morel
.