CVE-2017-10803

published 2017-07-04

CVE-2017-10803: In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database…

Priority P3 39 medium 6.5 CVSS 3.0

AV L AC L PR H UI R S U C H I H A H

EXPLOIT

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	odoo	—	—
odoo	odoo	—	—
odoo	odoo	—	—
odoo	odoo	—	—

CVSS provenance

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 8.5 HIGH AV:N/AC:M/Au:S/C:C/I:C/A:C

vendor_debian 6.5 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502