Cross-site Scripting Vulnerability in Odoo Products by Odoo
CVE-2021-45071

5.3MEDIUM

Key Information:

Vendor

Odoo

Status
Odoo Community
Odoo Enterprise
Vendor
CVE Published:
25 April 2023

What is CVE-2021-45071?

A cross-site scripting vulnerability exists in Odoo Community 15.0 and earlier, as well as Odoo Enterprise 15.0 and earlier versions. This flaw allows remote attackers to inject arbitrary web scripts into victims' browsers by exploiting crafted uploaded file names. If successfully executed, this can lead to unauthorized access, manipulation of web content, or execution of malicious scripts, potentially compromising user data and overall application integrity.

Affected Version(s)

Odoo Community 0 <= 15.0

Odoo Enterprise 0 <= 15.0

References

https://github.com/odoo/odoo/issues/107697
https://www.debian.org/security/2023/dsa-5399

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lauri Vakkala
Anıl Yüksel
Agustin Maio
Johannes Moritz
.