Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HOdoo
APPOdoo≤ 11.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCECommand Injection
CWE
Related vulnerabilities
CVE-2021-44547CRITICAL9.1PL ✓same product
Privilege escalation przez błąd sandboxingu w Odoo 15.0
CVE-2018-15632CRITICAL9.1PL ✓same product
Odoo: Nieprawidłowa walidacja danych przy tworzeniu bazy — zdalne zainicjowanie pustej bazy
CVE-2018-14885CRITICAL9.8PL ✓same product
Odoo — błędna kontrola dostępu w menedżerze baz danych
CVE-2017-10804CRITICAL9.8PL ✓same product
Odoo – auth bypass przez truncację parametrów z bajtem null (0x00)
CVE-2024-12368HIGH8.1same product
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an int...