CVE-2018-14863

HIGH

Odoo Community 8.0-11.0 and Odoo Enterprise 9.0-11.0 - Authenticated Improper Access Control via RPC Framework

Title source: llm
STIX 2.1

Description

Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.

References (1)

Core 1
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/odoo/odoo/issues/32508

Scores

CVSS v3 8.1
EPSS 0.0096
EPSS Percentile 57.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-284
Status published
Products (3)
odoo/odoo 9.0 (2 CPE variants)
odoo/odoo 10.0 (2 CPE variants)
odoo/odoo 11.0 (2 CPE variants)
Published Jul 03, 2019
Tracked Since Feb 18, 2026