Description

Odoo is a suite of business management software

Odoo DB manager is designed to be accessed by high privileged users only. It's not recommended to have Odoo DB manager publicly accessible even with enabled 'Masted Password'.

Remediation

Restrict access to Odoo DB manager

References

Odoo Help: securing /web/database/manager

Databases administration

Related Vulnerabilities

Dolphin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3728)

WordPress Plugin WP Maintenance Mode Multiple Vulnerabilities (2.0.3)

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-4390)

Unauthorized Access to a web app installer

Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2002-0422)

Severity

High

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Insecure Admin Access