description: Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests.
problem types: Improper Access Control
affected:
{
vendor: Odoo
product: Odoo Community
defaultStatus: unaffected
versions:
version: 0, status: affected, lessThanOrEqual: 13.0, versionType: semver
}
{
vendor: Odoo
product: Odoo Enterprise
defaultStatus: unaffected
versions:
version: 0, status: affected, lessThanOrEqual: 13.0, versionType: semver
}
metrics:
format: CVSS
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.0
]