CVE-2023-1434

Nuclei

Oodo Content-Type Cross-Site Scripting

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2023-1434.

Description

Insecure Content-Type validation Cross-Site Scripting in Oodo

Description source: VulnCheck

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 14, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Odoo

Browse Odoo / Odoo
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMOdoo - Cross-Site Scripting

Odoo is a business suite that has features for many business-critical areas, such as e-commerce, billing, or CRM. Versions before the 16.0 release are vulnerable to CVE-2023-1434 and is caused by an incorrect content type being set on an API endpoint.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patches or updates provided by the vendor to fix this vulnerability.

WeaknessesCWE-79
AuthorsDhiyaneshDK
Template tagscve2023cveodooxssvkevvuln
CPE: cpe:2.3:a:odoo:odoo:*:*:*:*:*:*:*:*
Shodan: title:"Odoo"
https://www.sonarsource.com/blog/odoo-get-your-content-type-right-or-else https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1434

Source: ProjectDiscovery