CVEvulnerability
CVE-2017-10804
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-07-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-306
Description
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.
Affected configurations
• odoo odoo 8.0
• odoo odoo 9.0
• odoo odoo 10.0
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3 Release Notes
- https://github.com/odoo/odoo/issues/17914 Patch, Third Party Advisory
- https://github.com/psycopg/psycopg2/issues/420 Exploit, Third Party Advisory
- http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3 Release Notes
- https://github.com/odoo/odoo/issues/17914 Patch, Third Party Advisory
- https://github.com/psycopg/psycopg2/issues/420 Exploit, Third Party Advisory