VulnerabilityModified
CVE-2021-44476
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.
MEDIUM 6.8EPSS 0.48%
Does this matter?
Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.
Description
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- EPSS
- 0.48% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-267
- Affected
- odoo/odoo
- Source
- security@odoo.com
References
- https://github.com/odoo/odoo/issues/107684Issue Tracking, Patch, Vendor Advisory
- https://www.debian.org/security/2023/dsa-5399
- https://github.com/odoo/odoo/issues/107684Issue Tracking, Patch, Vendor Advisory
- https://www.debian.org/security/2023/dsa-5399
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.