CVE-2018-14860: OS Command Injection

Q: What is CVE-2018-14860?

CVE-2018-14860 is a vulnerability in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier that allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.

Q: How severe is CVE-2018-14860?

CVE-2018-14860 has a severity level of critical with a CVSS score of 9.1.

Q: How can I fix CVE-2018-14860?

To fix CVE-2018-14860, it is recommended to upgrade to a fixed version of Odoo Community or Odoo Enterprise.

Q: Where can I find more information about CVE-2018-14860?

You can find more information about CVE-2018-14860 in the GitHub issue: https://github.com/odoo/odoo/issues/32505

Published Jul 3, 2019

Updated

Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.

Affected Software

2 affected components

Odoo<=11.0

Remediation

Patch Available

https://github.com/odoo/odoo/issues/32505

Event History

Jul 3, 2019

CVE Published

via MITRE·07:01 PM

Data Sourced

via MITRE·07:01 PM

Description

Frequently Asked Questions

What is CVE-2018-14860?

CVE-2018-14860 is a vulnerability in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier that allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.

How severe is CVE-2018-14860?

CVE-2018-14860 has a severity level of critical with a CVSS score of 9.1.

What software versions are affected by CVE-2018-14860?

Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier are affected by CVE-2018-14860.

How can I fix CVE-2018-14860?