CVE-2018-14865

MEDIUM

Odoo Community 9.0-11.0 and Enterprise 9.0-11.0 - Local File Read via wkhtmltopdf Report Engine

Title source: llm
STIX 2.1

Description

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.

References (1)

Core 1
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/odoo/odoo/issues/32501

Scores

CVSS v3 6.5
EPSS 0.0153
EPSS Percentile 71.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (3)
odoo/odoo 9.0 (2 CPE variants)
odoo/odoo 10.0 (2 CPE variants)
odoo/odoo 11.0 (2 CPE variants)
Published Jul 03, 2019
Tracked Since Feb 18, 2026