CVE-2017-10805 — Incorrect Authorization in Odoo

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.3%
top 44.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OdooDebian Odoo
Timeline
PublishedJul 4
Latest updateMay 13

Description

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDodoo/odoo10.0, 8.0, 9.0+2
▶debiandebian/odoo

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-3vjg-5f33-hxhc: In Odoo 8↗2022-05-13
▶

📋Vendor Advisories

1
Debian
CVE-2017-10805: odoo - In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9....↗2017
▶