CVE-2018-14886

The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.

CVSS v3 4.9 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/odoo/odoo/commits/master	Third Party Advisory
https://github.com/odoo/odoo/issues/32513	Patch Third Party Advisory
https://github.com/odoo/odoo/commits/master	Third Party Advisory
https://github.com/odoo/odoo/issues/32513	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:odoo:odoo:9.0::::community:::
	cpe:2.3:a:odoo:odoo:9.0::::enterprise:::
	cpe:2.3:a:odoo:odoo:10.0::::community:::
	cpe:2.3:a:odoo:odoo:10.0::::enterprise:::
	cpe:2.3:a:odoo:odoo:11.0::::community:::
	cpe:2.3:a:odoo:odoo:11.0::::enterprise:::

History

21 Nov 2024, 03:50

Type	Values Removed	Values Added
References	~~() https://github.com/odoo/odoo/commits/master - Third Party Advisory~~	() https://github.com/odoo/odoo/commits/master - Third Party Advisory
References	~~() https://github.com/odoo/odoo/issues/32513 - Patch, Third Party Advisory~~	() https://github.com/odoo/odoo/issues/32513 - Patch, Third Party Advisory

Information

Published : 2019-06-28 18:15

Updated : 2024-11-21 03:50

NVD link : CVE-2018-14886

Mitre link : CVE-2018-14886

CVE.ORG link : CVE-2018-14886

JSON object : View

Products Affected

odoo

odoo

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2018-14886", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2019-06-28T18:15:10.567", "references": [{"url": "https://github.com/odoo/odoo/commits/master", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/odoo/odoo/issues/32513", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/odoo/odoo/commits/master", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/odoo/odoo/issues/32513", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description."}, {"lang": "es", "value": "El procesador de descripci\u00f3n de m\u00f3dulos en Odoo Community versi\u00f3n 11.0 y versiones anteriores y Odoo Enterprise versi\u00f3n 11.0 y versiones anteriores no deshabilita la inclusi\u00f3n de archivos locales de RST, lo que permite a los usuarios autenticados privilegiados leer archivos locales a trav\u00e9s de una descripci\u00f3n de m\u00f3dulo manipulada."}], "lastModified": "2024-11-21T03:50:00.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"}, {"criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "167C709E-C8B2-4CCB-963E-E1D8C664190A"}, {"criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"}, {"criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A4405E54-6C16-49D5-B632-3D72091B2FEB"}, {"criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"}, {"criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1298CF62-A06E-48AD-8141-0541DE3F6381"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}