Description

Odoo is a suite of business management software

Odoo DB manager is designed to be accessed by high privileged users only. It's not recommended to have Odoo DB manager publicly accessible even with enabled 'Masted Password'.

Remediation

Restrict access to Odoo DB manager

References

Odoo Help: securing /web/database/manager

Databases administration

Related Vulnerabilities

Tracy debugging tool enabled

Web application default/weak credentials

Sensitive Data Exposure

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4360)

Typo3 Install Tool publicly accessible

Severity

High

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Insecure Admin Access