{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-28T17:27:55", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/odoo/odoo/commits/master"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/odoo/odoo/issues/32513"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-14886", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/odoo/odoo/commits/master", "refsource": "MISC", "url": "https://github.com/odoo/odoo/commits/master"}, {"name": "https://github.com/odoo/odoo/issues/32513", "refsource": "CONFIRM", "url": "https://github.com/odoo/odoo/issues/32513"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T09:46:23.771Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/odoo/odoo/commits/master"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/odoo/odoo/issues/32513"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-14886", "datePublished": "2019-06-28T17:27:55", "dateReserved": "2018-08-03T00:00:00", "dateUpdated": "2024-08-05T09:46:23.771Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*", "matchCriteriaId": "C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "167C709E-C8B2-4CCB-963E-E1D8C664190A", "vulnerable": true}, {"criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*", "matchCriteriaId": "C52F2EEB-11E5-49E8-AD06-3014FF2C2D24", "vulnerable": true}, {"criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "A4405E54-6C16-49D5-B632-3D72091B2FEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*", "matchCriteriaId": "38424B03-4121-4A79-8E4E-4CB4DCD3E4A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "1298CF62-A06E-48AD-8141-0541DE3F6381", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description."}, {"lang": "es", "value": "El procesador de descripci\u00f3n de m\u00f3dulos en Odoo Community versi\u00f3n 11.0 y versiones anteriores y Odoo Enterprise versi\u00f3n 11.0 y versiones anteriores no deshabilita la inclusi\u00f3n de archivos locales de RST, lo que permite a los usuarios autenticados privilegiados leer archivos locales a trav\u00e9s de una descripci\u00f3n de m\u00f3dulo manipulada."}], "id": "CVE-2018-14886", "lastModified": "2024-11-21T03:50:00.927", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-06-28T18:15:10.567", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/odoo/odoo/commits/master"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/odoo/odoo/issues/32513"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/odoo/odoo/commits/master"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/odoo/odoo/issues/32513"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}