CVE-2020-29396 - A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation

Back Back to CVE browser

HIGH

A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation

Published Dec 22, 2020

8.8

HIGH

CVSS 3.1

EPSS 3.23%

Description

A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.

Affected products

Vendor Odoo Product Odoo Community Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <=13.0
Vendor Odoo Product Odoo Enterprise Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <=13.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Odoo

Odoo Community

n/a

Version	Status	Constraints
11.0	affected	<unspecified
unspecified	affected	<=13.0

Odoo

Odoo Enterprise

n/a

Version	Status	Constraints
11.0	affected	<unspecified
unspecified	affected	<=13.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-267

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21769
Advisory
https://github.com/odoo/odoo/issues/63712
x_refsource_MISCPatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21769		Advisory
https://github.com/odoo/odoo/issues/63712		x_refsource_MISCPatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html		x_refsource_MISCPatchThird Party Advisory