CVEvulnerability

CVE-2021-23203

7.5 HIGH Published 2023-04-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284, CWE-863

Description

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.

Affected configurations

• odoo odoo 14.0 • odoo odoo 15.0

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References