Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-14864

Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment.

Published

2019-07-03T19:15:10.707

Last Modified

2024-11-21T03:49:57.220

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-284
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application odoo odoo 8.0 Yes
Application odoo odoo 8.0 Yes
Application odoo odoo 9.0 Yes
Application odoo odoo 9.0 Yes
Application odoo odoo 10.0 Yes
Application odoo odoo 10.0 Yes
References