CVE-2021-23203: High severity odoo vulnerability

Published Apr 25, 2023

Updated

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.

Affected Software

5 affected componentsFixes available

debian/odoo

14.0.0+dfsg.2-7+deb11u116.0.0+dfsg.2-1.1

Odoo=14.0

Odoo=15.0

Remediation

Patch Available

https://github.com/odoo/odoo/issues/107695

Event History

Apr 25, 2023

CVE Published

via MITRE·06:35 PM

Data Sourced

via MITRE·06:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-23203?

CVE-2021-23203 is a vulnerability that allows remote attackers to download PDF reports for arbitrary documents in Odoo Community 14.0 through 15.0 and Odoo Enterprise 14.0 through 15.0.

How severe is CVE-2021-23203?

CVE-2021-23203 has a severity value of 7.5 (high).

How can the CVE-2021-23203 vulnerability be exploited?

The CVE-2021-23203 vulnerability can be exploited by sending crafted requests to the reporting engine of Odoo, allowing remote attackers to download PDF reports for arbitrary documents.

Which versions of Odoo are affected by CVE-2021-23203?

Odoo Community versions 14.0 through 15.0 and Odoo Enterprise versions 14.0 through 15.0 are affected by CVE-2021-23203.

How can I fix CVE-2021-23203?

To fix CVE-2021-23203, you should update to the latest patched version of Odoo provided by the vendor.