CVE-2021-23203
EUVD-2021-1030825.04.2023, 19:15
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| odoo | odoo | 14.0 |
| odoo | odoo | 14.0 |
| odoo | odoo | 15.0 |
| odoo | odoo | 15.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.