CVE-2018-14865

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/odoo/odoo/issues/32501	Patch Third Party Advisory
https://github.com/odoo/odoo/issues/32501	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:odoo:odoo:9.0::::community:::
	cpe:2.3:a:odoo:odoo:9.0::::enterprise:::
	cpe:2.3:a:odoo:odoo:10.0::::community:::
	cpe:2.3:a:odoo:odoo:10.0::::enterprise:::
	cpe:2.3:a:odoo:odoo:11.0::::community:::
	cpe:2.3:a:odoo:odoo:11.0::::enterprise:::

History

21 Nov 2024, 03:49

Type	Values Removed	Values Added
References	~~() https://github.com/odoo/odoo/issues/32501 - Patch, Third Party Advisory~~	() https://github.com/odoo/odoo/issues/32501 - Patch, Third Party Advisory

Information

Published : 2019-07-03 19:15

Updated : 2024-11-21 03:49

NVD link : CVE-2018-14865

Mitre link : CVE-2018-14865

CVE.ORG link : CVE-2018-14865

JSON object : View

Products Affected

odoo

odoo

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2018-14865", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-07-03T19:15:10.767", "references": [{"url": "https://github.com/odoo/odoo/issues/32501", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/odoo/odoo/issues/32501", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files."}, {"lang": "es", "value": "El motor de informes en Odoo Community versi\u00f3n 9.0 hasta la versi\u00f3n 11.0 y versiones anteriores y Odoo Enterprise versi\u00f3n 9.0 hasta la versi\u00f3n 11.0 y versiones anteriores no usa opciones seguras al pasar documentos a wkhtmltopdf, lo que permite a los atacantes remotos leer archivos locales."}], "lastModified": "2024-11-21T03:49:57.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"}, {"criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "167C709E-C8B2-4CCB-963E-E1D8C664190A"}, {"criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"}, {"criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A4405E54-6C16-49D5-B632-3D72091B2FEB"}, {"criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"}, {"criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1298CF62-A06E-48AD-8141-0541DE3F6381"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}