CVE-2018-14887

MEDIUM

Odoo Community/Enterprise <= 11.0 - DoS & Database Name Disclosure via Host Header Injection

Title source: llm

Description

Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://github.com/odoo/odoo/commits/master

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://github.com/odoo/odoo/issues/32511

Scores

CVSS v3 6.5

EPSS 0.0181

EPSS Percentile 75.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Details

CWE

CWE-20

Status published

Products (3)

odoo/odoo 9.0 (2 CPE variants)

odoo/odoo 10.0 (2 CPE variants)

odoo/odoo 11.0 (2 CPE variants)

Published Jun 28, 2019

Tracked Since Feb 18, 2026