CVE-2018-14866

MEDIUM

Odoo Community <= 11.0 and Odoo Enterprise <= 11.0 - Authenticated Data Access in TransientModel Framework

Title source: llm
STIX 2.1

Description

Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.

References (1)

Core 1
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/odoo/odoo/issues/32509

Scores

CVSS v3 4.3
EPSS 0.0079
EPSS Percentile 51.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-732
Status published
Products (3)
odoo/odoo 9.0 (2 CPE variants)
odoo/odoo 10.0 (2 CPE variants)
odoo/odoo 11.0 (2 CPE variants)
Published Jul 03, 2019
Tracked Since Feb 18, 2026