Vulnerability CVE-2018-15631
Published: 2019-04-09

Description:
Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request.

Type:

CWE-269

 (Improper Privilege Management)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
ODOO -> ODOO 

 References:
https://github.com/odoo/odoo/issues/32516
https://www.excellium-services.com/cert-xlm-advisory/cve-2018-15631/
Copyright 2024, cxsecurity.com

 

Back to Top