CVE-2021-26947
published 2023-04-25CVE-2021-26947: Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script…
PriorityP335medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.41%
69.3th percentile
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | odoo | < odoo 14.0.0+dfsg.2-7+deb11u1 (bullseye) | odoo 14.0.0+dfsg.2-7+deb11u1 (bullseye) |
| odoo | odoo | <= 15.0 | — |
| odoo | odoo | >= 0 < 14.0.0+dfsg.2-7+deb11u1 | 14.0.0+dfsg.2-7+deb11u1 |
| odoo | odoo_community | <= 15.0 | — |
| odoo | odoo_enterprise | <= 15.0 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-raspi-5.4 vulnerabilities
osv·2025-01-06·CVSS 5.5
linux-raspi-5.4 vulnerabilities
linux-raspi-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- S390 architecture;
- x86 architecture;
- Power management core;
- GPU drivers;
- InfiniBand drivers;
- Network drivers;
- S/390 drivers;
- TTY drivers;
- BTRFS file system;
- EROFS file system;
- F2FS file system;
- File systems infrastructure;
- BPF subsystem;
- Socket messages infrastructure;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- SELinux security module;
(CVE-2022-48938, CVE-2024-42156, CVE-2024-36953, CVE-2024-38538,
CVE-2021-47501, CVE-2024-42068, CVE-2024-26947, CVE-2024-46724,
CVE-2024-
OSV
linux-iot vulnerabilities
osv·2024-12-20·CVSS 5.5
linux-iot vulnerabilities
linux-iot vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- S390 architecture;
- x86 architecture;
- Power management core;
- GPU drivers;
- InfiniBand drivers;
- Network drivers;
- S/390 drivers;
- TTY drivers;
- BTRFS file system;
- EROFS file system;
- F2FS file system;
- File systems infrastructure;
- BPF subsystem;
- Socket messages infrastructure;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- SELinux security module;
(CVE-2022-48938, CVE-2024-42156, CVE-2024-36953, CVE-2024-38538,
CVE-2021-47501, CVE-2024-42068, CVE-2024-26947, CVE-2024-46724,
CVE-2024-36968,
OSV
linux-aws, linux-aws-5.4 vulnerabilities
osv·2024-12-17·CVSS 5.5
linux-aws, linux-aws-5.4 vulnerabilities
linux-aws, linux-aws-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- S390 architecture;
- x86 architecture;
- Power management core;
- GPU drivers;
- InfiniBand drivers;
- Network drivers;
- S/390 drivers;
- TTY drivers;
- BTRFS file system;
- EROFS file system;
- F2FS file system;
- File systems infrastructure;
- BPF subsystem;
- Socket messages infrastructure;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- SELinux security module;
(CVE-2022-48938, CVE-2024-42156, CVE-2024-36953, CVE-2024-38538,
CVE-2021-47501, CVE-2024-42068, CVE-2024-26947, CVE-2024-46724,
GHSA
GHSA-73p2-3xgj-j397: Cross-site scripting (XSS) issue Odoo Community 15
ghsa_unreviewed·2023-04-25
CVE-2021-26947 [MEDIUM] CWE-79 GHSA-73p2-3xgj-j397: Cross-site scripting (XSS) issue Odoo Community 15
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.
OSV
CVE-2021-26947: Cross-site scripting (XSS) issue Odoo Community 15
osv·2023-04-25·CVSS 6.1
CVE-2021-26947 [MEDIUM] CVE-2021-26947: Cross-site scripting (XSS) issue Odoo Community 15
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.
Debian
CVE-2021-26947: odoo - Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterp...
vendor_debian·2021·CVSS 6.1
CVE-2021-26947 [MEDIUM] CVE-2021-26947: odoo - Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterp...
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.
Scope: local
bullseye: resolved (fixed in 14.0.0+dfsg.2-7+deb11u1)
sid: resolved (fixed in 16.0.0+dfsg.1-1)
No detection rules found.
Nuclei
Odoo <= 15.0 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2021-26947 [MEDIUM] Odoo <= 15.0 - Cross-Site Scripting
Odoo alert(document.domain)"
- "{{BaseURL}}/web/signup?error="
- "{{BaseURL}}/web/reset_password?error="
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- 'contains_any(body, "alert(document.domain)", "", "")'
- 'contains_any(body, "content=\"Odoo", "var odoo", "Odoo")'
- 'contains(content_type, "text/html")'
- 'status_code == 200'
condition: and
# digest: 490a0046304402207440f15300e22deae748a0177f6403e6df5d4b86600508ba0704ac8bdbca0edc022059293cb4c16dff1f8b7fb825698ba3deb4004b59856c86fe87a5580fa020bb3f:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2023-04-25
Published