CVE-2018-14863: High severity odoo vulnerability
Published Jul 3, 2019
·Updated
Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.
Affected Software
6 affected components
Odoo=9.0
Odoo=9.0
Odoo=10.0
Odoo=10.0
Odoo=11.0
Odoo=11.0
Remediation
Patch Available
Event History
Jul 3, 2019
CVE Published
via MITRE·06:53 PM
Data Sourced
via MITRE·06:53 PM
Description
Frequently Asked Questions
1
What is CVE-2018-14863?
CVE-2018-14863 is a vulnerability in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 that allows authenticated users to call private functions via RPC.
2
How severe is CVE-2018-14863?
CVE-2018-14863 has a severity rating of 8.1 (high).
3
Which versions of Odoo are affected by CVE-2018-14863?
Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 are affected by CVE-2018-14863.
4
How can the incorrect access control vulnerability be exploited?
Authenticated users can exploit the incorrect access control vulnerability by calling private functions via RPC.
5
Is there a fix available for CVE-2018-14863?
It is recommended to update to the latest version of Odoo Community or Odoo Enterprise to fix CVE-2018-14863.