Description
Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation.
References (1)
Core 1
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/odoo/odoo/issues/42196
Scores
CVSS v3
8.1
EPSS
0.0206
EPSS Percentile
79.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-284
Status
published
Products (1)
odoo/odoo
13.0 (2 CPE variants)
Published
Dec 19, 2019
Tracked Since
Feb 18, 2026