Odoo · Odoo Enterprise · CVE-2018-15634
Name of the Vulnerable Software and Affected Versions:
Odoo Community versions 14.0 and earlier
Odoo Enterprise versions 14.0 and earlier
Description:
The issue is a cross-site scripting (XSS) problem in the attachment management of Odoo. This allows remote attackers to inject arbitrary web script into the browser of a victim via a crafted link.
Recommendations:
For Odoo Community versions 14.0 and earlier, update to a version later than 14.0 to resolve the issue.
For Odoo Enterprise versions 14.0 and earlier, update to a version later than 14.0 to resolve the issue.
As a temporary workaround, consider restricting access to the attachment management feature until a patch is available.