ByteOS Network

NVD Vulnerability Details :

CVE-2018-14867

Analyzed

Source-cve@mitre.org

Published At-28 Jun, 2019 | 18:15

Updated At-05 Jul, 2019 | 13:24

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:N/I:P/A:N

CPE Matches

odoo>>odoo>>9.0

cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*

odoo>>odoo>>9.0

cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*

odoo>>odoo>>10.0

cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*

odoo>>odoo>>10.0

cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-284	Primary	nvd@nist.gov

CWE ID: CWE-284

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/odoo/odoo/commits/master	cve@mitre.org	Third Party Advisory
https://github.com/odoo/odoo/issues/32503	cve@mitre.org	Patch Third Party Advisory

Hyperlink: https://github.com/odoo/odoo/commits/master

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://github.com/odoo/odoo/issues/32503

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History