by Kastro
Paper/Archive/CVE-2020-29396

CVE-2020-29396

Odoo Odoo Community — A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allo…

EPSS 3%CVSS 9.9
critical.is priorityof 100
47
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 87.9.879 × 2017.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.

Affected

ProductAffectedFixed inSource
Odoo Community11.0 – < unspecifiedunspecifiedCNA
Odoo Enterprise11.0 – < unspecifiedunspecifiedCNA
Odoo Communityunspecified – 13.0–CNA
Odoo Enterpriseunspecified – 13.0–CNA

Scores by source

odoo (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References

refgithub.com/odoo/odoo/issues/63712reforacle.com/security-alerts/cpujul2022.html