CVE-2021-23186
Assigner: odoo
Published: 2023-04-25T18:33:36.536Z
State: PUBLISHED
affected: vendor: Odoo
product: Odoo Community
defaultStatus: unaffected
versions: version: 0
status: affected
lessThanOrEqual: 15.0
versionType: semver
vendor: Odoo
product: Odoo Enterprise
defaultStatus: unaffected
versions: version: 0
status: affected
lessThanOrEqual: 15.0
versionType: semver
descriptions: value: A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tenants, in a multi-tenant system.
metrics: format: CVSS
cvssV3_0: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
version: 3.0
problemTypes: descriptions: cweid: CWE-267
description: Privilege Defined With Unsafe Actions
type: CWE
credits: value: Nils Hamerlinck
type: finder