CVE-2017-10803

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used.

CVSS v3.0

6.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

3.59% chance of exploitation in the next 30 days, 89th percentile

Published

2017-07-04

Updated

2024-08-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44064

References

• CVE Record
• NVD entry

Related

• CVE-2017-10795
• CVE-2017-1082
• CVE-2017-10790
• CVE-2017-1083
• CVE-2017-10724
• CVE-2017-1084