Cross-Site Scripting Vulnerability in Odoo Enterprise Accounting App
CVE-2021-44461

6.5MEDIUM

Key Information:

Vendor

Odoo

Status
Odoo Enterprise
Vendor
CVE Published:
25 April 2023

What is CVE-2021-44461?

This vulnerability allows remote attackers to exploit the Accounting app in Odoo Enterprise versions 13.0 through 15.0 by injecting arbitrary web scripts. If attackers gain control over accounting journal entries, they can execute scripts in the web browser of a victim, potentially leading to unauthorized data access or manipulation.

Affected Version(s)

Odoo Enterprise 13.0 <= 15.0

References

https://github.com/odoo/odoo/issues/107686

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.