« Volver al listado

CVE-2018-14865

Estado: ModificadaMedia (6.5)—

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Odoo — Odoo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-14865",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-03T19:15:10.767",
  "references": [
    {
      "url": "https://github.com/odoo/odoo/issues/32501",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/odoo/odoo/issues/32501",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files."
    },
    {
      "lang": "es",
      "value": "El motor de informes en Odoo Community versión 9.0 hasta la versión 11.0 y versiones anteriores y Odoo Enterprise versión 9.0 hasta la versión 11.0 y versiones anteriores no usa opciones seguras al pasar documentos a wkhtmltopdf, lo que permite a los atacantes remotos leer archivos locales."
    }
  ],
  "lastModified": "2026-06-17T01:41:47.183",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "167C709E-C8B2-4CCB-963E-E1D8C664190A"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52F2EEB-11E5-49E8-AD06-3014FF2C2D24"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4405E54-6C16-49D5-B632-3D72091B2FEB"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38424B03-4121-4A79-8E4E-4CB4DCD3E4A5"
            },
            {
              "criteria": "cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1298CF62-A06E-48AD-8141-0541DE3F6381"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}