description: Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.
problem types: Cross-site Scripting (XSS)
affected:
{
vendor: Odoo
product: Odoo Community
defaultStatus: unaffected
versions:
version: 0, status: affected, lessThanOrEqual: 15.0, versionType: semver
}
{
vendor: Odoo
product: Odoo Enterprise
defaultStatus: unaffected
versions:
version: 0, status: affected, lessThanOrEqual: 15.0, versionType: semver
}
metrics:
format: CVSS
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.0
]