CVE-2017-10805

HIGH

Odoo 8.0, 9.0, 10.0 - Authenticated OAuth Session Hijacking via Incorrect Access Control

Title source: llm

Description

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users.

References (1)

Core 1

Core References

Mitigation, Patch, Third Party Advisory x_refsource_confirm

https://github.com/odoo/odoo/issues/17921

Scores

CVSS v3 8.8

EPSS 0.0100

EPSS Percentile 58.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-863

Status published

Products (3)

odoo/odoo 8.0

odoo/odoo 9.0 (2 CPE variants)

odoo/odoo 10.0 (2 CPE variants)

Published Jul 04, 2017

Tracked Since Feb 18, 2026