CVE-2018-15631

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request.

Score

CVSS 3.1 6.5 Medium

Status

Modified - security@odoo.com

Published

2019-04-09

Last modified

2024-08-05

Weaknesses

CWE-284

Affected products

• Odoo (Odoo)
• Odoo Community (Odoo)
• Odoo Enterprise (Odoo)

References

• https://github.com/odoo/odoo/issues/32516
• https://www.excellium-services.com/cert-xlm-advisory/cve-2018-15631/