In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOdoo
APPOdoo10.08.09.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
Related vulnerabilities
CVE-2021-44547CRITICAL9.1PL ✓same product
Privilege escalation przez błąd sandboxingu w Odoo 15.0
CVE-2018-15632CRITICAL9.1PL ✓same product
Odoo: Nieprawidłowa walidacja danych przy tworzeniu bazy — zdalne zainicjowanie pustej bazy
CVE-2018-14860CRITICAL9.1PL ✓same product
Odoo – command injection w silniku dynamicznych wyrażeń (RCE)
CVE-2018-14885CRITICAL9.8PL ✓same product
Odoo — błędna kontrola dostępu w menedżerze baz danych
CVE-2024-12368HIGH8.1same product
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an int...