description: Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
problem types: Improper Access Control
affected:
{
vendor: Odoo
product: Odoo Community
defaultStatus: unaffected
versions:
version: 14.0, status: affected, lessThanOrEqual: 15.0, versionType: semver
}
{
vendor: Odoo
product: Odoo Enterprise
defaultStatus: unaffected
versions:
version: 14.0, status: affected, lessThanOrEqual: 15.0, versionType: semver
}
metrics:
format: CVSS
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]