description: Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Odoo Community
vendor: Odoo
versions:
lessThan: unspecified, status: affected, version: 11.0, versionType: custom
}
{
product: Odoo Enterprise
vendor: Odoo
versions:
lessThan: unspecified, status: affected, version: 11.0, versionType: custom
}
{
product: Odoo Community
vendor: Odoo
versions:
lessThanOrEqual: 14.0, status: affected, version: unspecified, versionType: custom
}
{
product: Odoo Enterprise
vendor: Odoo
versions:
lessThanOrEqual: 14.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.0
]