« Volver al listado

CVE-2018-15641

Estado: ModificadaMedia (5.4)—

Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Odoo — Odoo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-15641",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@odoo.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.1
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@odoo.com",
      "affectedData": [
        {
          "vendor": "Odoo",
          "product": "Odoo Community",
          "versions": [
            {
              "status": "affected",
              "version": "11.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Odoo",
          "product": "Odoo Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "11.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Odoo",
          "product": "Odoo Community",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "14.0"
            }
          ]
        },
        {
          "vendor": "Odoo",
          "product": "Odoo Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "14.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-22T17:15:12.940",
  "references": [
    {
      "url": "https://github.com/odoo/odoo/issues/63704",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@odoo.com"
    },
    {
      "url": "https://github.com/odoo/odoo/issues/63704",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@odoo.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes."
    },
    {
      "lang": "es",
      "value": "Un problema de tipo cross-site scripting (XSS) en el módulo web en Odoo Community versiones 11.0 hasta 14.0 y Odoo Enterprise versiones 11.0 hasta 14.0, permite a usuarios internos autenticados remotos inyectar un script web arbitrario en el navegador de una víctima por medio de atributos de eventos de calendario diseñados"
    }
  ],
  "lastModified": "2026-06-17T01:42:52.397",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4ED3084D-DF4C-486F-A161-ADCC24FF61F4",
              "versionEndIncluding": "14.0",
              "versionStartIncluding": "11.0"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBE9D00C-0BB2-4086-B6E3-C5AEC39070C1",
              "versionEndIncluding": "14.0",
              "versionStartIncluding": "11.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@odoo.com"
}