description: Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a crafted name.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Odoo Community
vendor: Odoo
versions:
lessThanOrEqual: 12.0, status: affected, version: unspecified, versionType: custom
}
{
product: Odoo Enterprise
vendor: Odoo
versions:
lessThanOrEqual: 12.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.0
]