Nils Hamerlinck

The issue is related to improper access control, allowing remote authenticated users to trigger the creation of demonstration data. This includes user accounts with known credentials.

The issue allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link. This is a cross-site scripting (XSS) issue.

A sandboxing issue allows authenticated administrators to access and modify database contents of other tenants in a multi-tenant system.

A sandboxing issue allows authenticated administrators to read and write local files on the server.

O problema está relacionado a um controle de acesso inadequado no módulo de e-mail, afetando especificamente os parceiros de canal. Isso permite que usuários remotos autenticados se inscrevam em canais de e-mail arbitrários sem um convite.

**Nome do software vulnerável e versões afetadas: Versões 12.0 e anteriores do Odoo Community Versões 12.0 e anteriores do Odoo Enterprise Descrição: O problema está relacionado a um controle de acesso inadequado no roteamento de mensagens, permitindo que usuários remotos autenticados criem registros arbitrários por meio de cargas maliciosas. Isso pode levar à escalada de privilégios. Recomendações: Para as versões 12.0 e anteriores do Odoo Community, atualize para uma versão que inclua os patches de segurança necessários para corrigir o problema de controle de acesso inadequado. Para as versões 12.0 e anteriores do Odoo Enterprise, atualize para uma versão que inclua os patches de segurança necessários para corrigir o problema de controle de acesso inadequado. Como solução temporária, considere restringir o acesso à funcionalidade de roteamento de mensagens para minimizar o risco de exploração.

O problema está relacionado a um controle de acesso inadequado no módulo de e-mail (seguidores) do Odoo Community e do Odoo Enterprise. Isso permite que usuários autenticados remotamente obtenham acesso a mensagens postadas em registros comerciais aos quais não tinham acesso e se inscrevam para receber mensagens futuras.

The issue is related to incorrect access control in asset bundles, allowing remote authenticated users to inject arbitrary web script via a crafted attachment.

The issue is related to incorrect access control in the Password Encryption module, allowing authenticated users to change the password of other users without knowing their current password via a crafted RPC call.

The issue is related to incorrect access control in the portal messaging system, allowing remote attackers to post messages on behalf of customers and guess document attribute values via crafted parameters.

The issue concerns a ReDoS (regular expression denial of service) vulnerability in the dbfilter from header module provided by the Odoo Community Association (OCA). This vulnerability affects Odoo under certain circumstances.

The issue is related to improper Host header sanitization in the dbfilter routing component. This allows a remote attacker to deny access to the service and disclose database names via a crafted request.

The report engine in Odoo does not use secure options when passing documents to wkhtmltopdf, allowing remote attackers to read local files.

The issue is related to incorrect access control in the RPC framework, allowing authenticated users to call private functions via RPC.

The issue is related to incorrect access control in the mail templating system, allowing authenticated internal users to delete arbitrary menu items via a crafted RPC request.

The issue is related to improper data access control, allowing authenticated users to export secure hashed passwords of other users via a CSV export.

The issue is related to incorrect access control in the password reset component, allowing authenticated users to reset the password of other users by being the first party to use the secure token.

The issue allows remote authenticated users to read arbitrary local files readable by the Odoo service due to a directory traversal vulnerability in `tools.file open`.