« Volver al listado

CVE-2017-10803

Estado: ModificadaMedia (6.5)—💥 Exploit

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Odoo — Odoo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-10803",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.6
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-04T18:29:00.177",
  "references": [
    {
      "url": "https://github.com/odoo/odoo/issues/17898",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/odoo/odoo/issues/17898",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used."
    },
    {
      "lang": "es",
      "value": "En Odoo versión 8.0, Odoo Community Edition versiones 9.0 y 10.0, y Odoo Enterprise Edition versiones 9.0 y 10.0, el manejo no seguro de datos de anonimización en el módulo de Anonimización de Base de Datos permite que los usuarios privilegiados identificados remotos ejecuiten código Python arbitrario, porque es utilizado unpickle."
    }
  ],
  "lastModified": "2026-06-17T01:00:44.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D140CBF-E659-4E87-8FEE-F19CD2E6B947"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "167C709E-C8B2-4CCB-963E-E1D8C664190A"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4405E54-6C16-49D5-B632-3D72091B2FEB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}