Description

A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.

Remediation

References

CVE-2020-29396

Related Vulnerabilities

OpenSSL Improper Input Validation Vulnerability (CVE-2017-3733)

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-5317)

Zenphoto Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-0995)

WordPress Plugin Instant Images-One Click Unsplash Uploads Cross-Site Scripting (4.4.0)

Moodle URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2022-35652)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-269 CVE-2020-29396