CVE-2018-15645 HIGH

CVE-2018-15645

Vendor Odoo
Product Odoo Community
Weakness CWE-284
Published December 22, 2020
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.

Key dates

02Disclosure timeline

December 22, 2020 CVE published
August 5, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-30539 Users can set up workflows using restricted and invisible system tags in Nextcloud CVE-2024-1294 Sunshine Photo Cart: Free Client Galleries for Photographers <= 3.0.24 - Unauthenticated Sensitive Information Exposure via Invoice CVE-2022-4709 Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import CVE-2025-59517 Windows Storage VSP Driver Elevation of Privilege Vulnerability CVE-2024-45392 SuiteCRM has wrong deletion permission checks on API delete call