Nils Hamerlinck

The issue is related to improper access control, allowing remote authenticated users to trigger the creation of demonstration data. This includes user accounts with known credentials.

The issue allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link. This is a cross-site scripting (XSS) issue.

A sandboxing issue allows authenticated administrators to access and modify database contents of other tenants in a multi-tenant system.

A sandboxing issue allows authenticated administrators to read and write local files on the server.

The issue is related to improper access control in the mail module, specifically affecting channel partners. This allows remote authenticated users to subscribe to arbitrary mail channels without an invitation.

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 12.0 and earlier Odoo Enterprise versions 12.0 and earlier Description: The issue is related to improper access control in message routing, allowing remote authenticated users to create arbitrary records via crafted payloads. This may lead to privilege escalation. Recommendations: For Odoo Community versions 12.0 and earlier, update to a version that includes the necessary security patches to fix the improper access control issue. For Odoo Enterprise versions 12.0 and earlier, update to a version that includes the necessary security patches to fix the improper access control issue. As a temporary workaround, consider restricting access to the message routing functionality to minimize the risk of exploitation.

The issue is related to improper access control in the mail module (followers) of Odoo Community and Odoo Enterprise. This allows remote authenticated users to obtain access to messages posted on business records they were not given access to, and subscribe to receive future messages.

The issue is related to incorrect access control in asset bundles, allowing remote authenticated users to inject arbitrary web script via a crafted attachment.

The issue is related to incorrect access control in the Password Encryption module, allowing authenticated users to change the password of other users without knowing their current password via a crafted RPC call.

The issue is related to incorrect access control in the portal messaging system, allowing remote attackers to post messages on behalf of customers and guess document attribute values via crafted parameters.

The issue concerns a ReDoS (regular expression denial of service) vulnerability in the dbfilter from header module provided by the Odoo Community Association (OCA). This vulnerability affects Odoo under certain circumstances.

The issue is related to improper Host header sanitization in the dbfilter routing component. This allows a remote attacker to deny access to the service and disclose database names via a crafted request.

The report engine in Odoo does not use secure options when passing documents to wkhtmltopdf, allowing remote attackers to read local files.

The issue is related to incorrect access control in the RPC framework, allowing authenticated users to call private functions via RPC.

The issue is related to incorrect access control in the mail templating system, allowing authenticated internal users to delete arbitrary menu items via a crafted RPC request.

The issue is related to improper data access control, allowing authenticated users to export secure hashed passwords of other users via a CSV export.

The issue is related to incorrect access control in the password reset component, allowing authenticated users to reset the password of other users by being the first party to use the secure token.

The issue allows remote authenticated users to read arbitrary local files readable by the Odoo service due to a directory traversal vulnerability in `tools.file open`.