description: A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
problem types: CWE-267: Privilege Defined With Unsafe Actions
affected:
{
product: Odoo Community
vendor: Odoo
versions:
lessThan: unspecified, status: affected, version: 11.0, versionType: custom
}
{
product: Odoo Enterprise
vendor: Odoo
versions:
lessThan: unspecified, status: affected, version: 11.0, versionType: custom
}
{
product: Odoo Community
vendor: Odoo
versions:
lessThanOrEqual: 13.0, status: affected, version: unspecified, versionType: custom
}
{
product: Odoo Enterprise
vendor: Odoo
versions:
lessThanOrEqual: 13.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.0
]