CVE-2018-15632 — Improper Input Validation in Community

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
0.6%
top 31.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Odoo CommunityOdoo EnterpriseOdoo+1 more
Timeline
PublishedDec 22
Latest updateMay 24

Description

Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages4 packages

▶CVEListV5odoo/odoo_communityunspecified — 11.0
▶CVEListV5odoo/odoo_enterpriseunspecified — 11.0
▶NVDodoo/odoo11.0
▶debiandebian/odoo

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-jr5f-4v8f-4m67: Improper input validation in database creation logic in Odoo Community 11↗2022-05-24
▶

📋Vendor Advisories

1
Debian
CVE-2018-15632: odoo - Improper input validation in database creation logic in Odoo Community 11.0 and ...↗2018
▶