CVE-2018-14865

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.
References
Link Resource
https://github.com/odoo/odoo/issues/32501 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*
cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*
cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*
cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*

History

No history.

Information

Published : 2019-07-03 19:15

Updated : 2024-02-04 20:20


NVD link : CVE-2018-14865

Mitre link : CVE-2018-14865

CVE.ORG link : CVE-2018-14865


JSON object : View

Products Affected

odoo

  • odoo
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor