CVE-2019-11780 - OpenCVE

Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Odoo	Odoo

Configuration 1 [-]

OR	cpe:2.3:a:odoo:odoo:13.0::::community:::
	cpe:2.3:a:odoo:odoo:13.0::::enterprise:::

References

Link	Resource
https://github.com/odoo/odoo/issues/42196	Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: odoo

Published: 2019-12-19T15:50:12

Updated: 2019-12-19T15:50:12

Reserved: 2019-05-06T00:00:00

Link: CVE-2019-11780

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-12-19T16:16:42.370

Modified: 2021-11-02T19:14:20.240

Link: CVE-2019-11780

JSON object: View

Redhat Information

No data.

CWE

{"containers": {"cna": {"affected": [{"product": "Odoo Community", "vendor": "Odoo", "versions": [{"status": "affected", "version": "13.0"}]}, {"product": "Odoo Enterprise", "vendor": "Odoo", "versions": [{"status": "affected", "version": "13.0"}]}], "credits": [{"lang": "en", "value": "Swapnesh Shah"}], "descriptions": [{"lang": "en", "value": "Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-12-19T15:50:12", "orgId": "22c90092-d340-4fb8-a06e-f1193e012523", "shortName": "odoo"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/odoo/odoo/issues/42196"}], "source": {"advisory": "ODOO-SA-2019-10-25-1", "discovery": "EXTERNAL"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@odoo.com", "ID": "CVE-2019-11780", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Odoo Community", "version": {"version_data": [{"version_affected": "=", "version_value": "13.0"}]}}, {"product_name": "Odoo Enterprise", "version": {"version_data": [{"version_affected": "=", "version_value": "13.0"}]}}]}, "vendor_name": "Odoo"}]}}, "credit": [{"lang": "eng", "value": "Swapnesh Shah"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://github.com/odoo/odoo/issues/42196", "refsource": "MISC", "url": "https://github.com/odoo/odoo/issues/42196"}]}, "source": {"advisory": "ODOO-SA-2019-10-25-1", "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "22c90092-d340-4fb8-a06e-f1193e012523", "assignerShortName": "odoo", "cveId": "CVE-2019-11780", "datePublished": "2019-12-19T15:50:12", "dateReserved": "2019-05-06T00:00:00", "dateUpdated": "2019-12-19T15:50:12", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:odoo:odoo:13.0:*:*:*:community:*:*:*", "matchCriteriaId": "4CE8B4A3-0EA3-4813-A511-16FB7D2B06AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:odoo:odoo:13.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "FDDB70FB-2B58-42B4-96CB-D8C8C152A6A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation."}, {"lang": "es", "value": "Un control de acceso inapropiado en el sistema de campos computarizados del framework de Odoo Community versi\u00f3n 13.0 y Odoo Enterprise versi\u00f3n 13.0, permite a atacantes autenticados remotos acceder a informaci\u00f3n confidencial por medio de peticiones RPC dise\u00f1adas, lo que podr\u00eda conllevar a una escalada de privilegios."}], "id": "CVE-2019-11780", "lastModified": "2021-11-02T19:14:20.240", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security@odoo.com", "type": "Secondary"}]}, "published": "2019-12-19T16:16:42.370", "references": [{"source": "security@odoo.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/odoo/odoo/issues/42196"}], "sourceIdentifier": "security@odoo.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "security@odoo.com", "type": "Secondary"}]}