CVE-2018-14865: Infoleak
Published Jul 3, 2019
·Updated
Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.
Affected Software
6 affected components
Odoo=9.0
Odoo=9.0
Odoo=10.0
Odoo=10.0
Odoo=11.0
Odoo=11.0
Remediation
Patch Available
Event History
Jul 3, 2019
CVE Published
via MITRE·06:40 PM
Data Sourced
via MITRE·06:40 PM
Description
Frequently Asked Questions
1
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2018-14865.
2
What is the severity level of CVE-2018-14865?
The severity level of CVE-2018-14865 is medium (6.5).
3
Which software versions are affected by CVE-2018-14865?
Odoo Community 9.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 are affected by CVE-2018-14865.
4
How does CVE-2018-14865 allow remote attackers to read local files?
CVE-2018-14865 allows remote attackers to read local files by not using secure options when passing documents to wkhtmltopdf in the report engine of Odoo.
5
Is there a fix available for CVE-2018-14865?
Yes, a fix is available for CVE-2018-14865. Please refer to the provided reference link for more information.