CVE-2021-23203 (GCVE-0-2021-23203)
Vulnerability from cvelistv5 – Published: 2023-04-25 18:35 – Updated: 2025-02-03 17:14
VLAI?
Summary
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Severity ?
7.5 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Odoo | Odoo Community |
Affected:
14.0 , ≤ 15.0
(semver)
|
|||||||
|
|||||||||
Credits
Tiffany Chang
iamsushi
Ranjit Pahan
Iago Ruiz
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:05:55.598Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/odoo/odoo/issues/107695"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5399"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-23203",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-03T17:13:00.406283Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-03T17:14:04.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Odoo Community",
"vendor": "Odoo",
"versions": [
{
"lessThanOrEqual": "15.0",
"status": "affected",
"version": "14.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Odoo Enterprise",
"vendor": "Odoo",
"versions": [
{
"lessThanOrEqual": "15.0",
"status": "affected",
"version": "14.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "eng",
"type": "finder",
"value": "Tiffany Chang"
},
{
"lang": "eng",
"type": "finder",
"value": "iamsushi"
},
{
"lang": "eng",
"type": "finder",
"value": "Ranjit Pahan"
},
{
"lang": "eng",
"type": "finder",
"value": "Iago Ruiz"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-15T00:27:54.327Z",
"orgId": "22c90092-d340-4fb8-a06e-f1193e012523",
"shortName": "odoo"
},
"references": [
{
"url": "https://github.com/odoo/odoo/issues/107695"
},
{
"url": "https://www.debian.org/security/2023/dsa-5399"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "22c90092-d340-4fb8-a06e-f1193e012523",
"assignerShortName": "odoo",
"cveId": "CVE-2021-23203",
"datePublished": "2023-04-25T18:35:38.489Z",
"dateReserved": "2021-07-20T14:28:12.189Z",
"dateUpdated": "2025-02-03T17:14:04.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:odoo:odoo:14.0:*:*:*:community:*:*:*\", \"matchCriteriaId\": \"4D952E47-04E1-4146-A3AA-3804A1AB52DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:odoo:odoo:14.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"BEB5354F-C1AC-48D6-8922-656F952442A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:odoo:odoo:15.0:*:*:*:community:*:*:*\", \"matchCriteriaId\": \"EBD0BABD-16C5-449D-8BE7-9E948A509FA5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:odoo:odoo:15.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"24A23452-4857-4F4B-AA5A-944F9073A554\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.\"}]",
"id": "CVE-2021-23203",
"lastModified": "2024-11-21T05:51:22.087",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security@odoo.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
"published": "2023-04-25T19:15:09.403",
"references": "[{\"url\": \"https://github.com/odoo/odoo/issues/107695\", \"source\": \"security@odoo.com\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5399\", \"source\": \"security@odoo.com\"}, {\"url\": \"https://github.com/odoo/odoo/issues/107695\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5399\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "security@odoo.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security@odoo.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-284\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-23203\",\"sourceIdentifier\":\"security@odoo.com\",\"published\":\"2023-04-25T19:15:09.403\",\"lastModified\":\"2025-02-03T18:15:27.300\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@odoo.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@odoo.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:odoo:odoo:14.0:*:*:*:community:*:*:*\",\"matchCriteriaId\":\"4D952E47-04E1-4146-A3AA-3804A1AB52DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:odoo:odoo:14.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"BEB5354F-C1AC-48D6-8922-656F952442A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:odoo:odoo:15.0:*:*:*:community:*:*:*\",\"matchCriteriaId\":\"EBD0BABD-16C5-449D-8BE7-9E948A509FA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:odoo:odoo:15.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"24A23452-4857-4F4B-AA5A-944F9073A554\"}]}]}],\"references\":[{\"url\":\"https://github.com/odoo/odoo/issues/107695\",\"source\":\"security@odoo.com\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5399\",\"source\":\"security@odoo.com\"},{\"url\":\"https://github.com/odoo/odoo/issues/107695\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5399\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"22c90092-d340-4fb8-a06e-f1193e012523\", \"shortName\": \"odoo\", \"dateUpdated\": \"2024-07-15T00:27:54.327Z\"}, \"affected\": [{\"vendor\": \"Odoo\", \"product\": \"Odoo Community\", \"defaultStatus\": \"unaffected\", \"versions\": [{\"version\": \"14.0\", \"status\": \"affected\", \"lessThanOrEqual\": \"15.0\", \"versionType\": \"semver\"}]}, {\"vendor\": \"Odoo\", \"product\": \"Odoo Enterprise\", \"defaultStatus\": \"unaffected\", \"versions\": [{\"version\": \"14.0\", \"status\": \"affected\", \"lessThanOrEqual\": \"15.0\", \"versionType\": \"semver\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.\"}], \"references\": [{\"url\": \"https://github.com/odoo/odoo/issues/107695\"}, {\"url\": \"https://www.debian.org/security/2023/dsa-5399\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-284\", \"description\": \"Improper Access Control\", \"type\": \"CWE\"}]}], \"credits\": [{\"lang\": \"eng\", \"value\": \"Tiffany Chang\", \"type\": \"finder\"}, {\"lang\": \"eng\", \"value\": \"iamsushi\", \"type\": \"finder\"}, {\"lang\": \"eng\", \"value\": \"Ranjit Pahan\", \"type\": \"finder\"}, {\"lang\": \"eng\", \"value\": \"Iago Ruiz\", \"type\": \"finder\"}]}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T19:05:55.598Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/odoo/odoo/issues/107695\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5399\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-23203\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-03T17:13:00.406283Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-03T17:13:50.253Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2021-23203\", \"assignerOrgId\": \"22c90092-d340-4fb8-a06e-f1193e012523\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"odoo\", \"dateReserved\": \"2021-07-20T14:28:12.189Z\", \"datePublished\": \"2023-04-25T18:35:38.489Z\", \"dateUpdated\": \"2025-02-03T17:14:04.331Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…