PT-2023-12083

CVE-2021-26263

Published

2023-04-25

Updated

2024-07-15

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Odoo Community versions 14.0 through 15.0 Odoo Enterprise versions 14.0 through 15.0

Description The issue is a cross-site scripting (XSS) problem in the Discuss app, allowing remote attackers to inject arbitrary web script in the browser of a victim by posting crafted contents.

Recommendations For Odoo Community versions 14.0 through 15.0, update to a version that includes a fix for this issue. For Odoo Enterprise versions 14.0 through 15.0, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the Discuss app until a patch is available.

Exploitability

Fix

Impacts

Researchers

Iamsushi

Ranjit Pahan

Theodoros Malachias

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers