CVE-2018-14859
Last modified
CVE-2018-14859 is a vulnerability of currently unknown severity. Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.. EPSS estimates a 0.96% chance of exploitation in the next 30 days.
Description
Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Odoo | Odoo | 9.0 |
| Odoo | Odoo | 10.0 |
| Odoo | Odoo | 11.0 |
References
- https://github.com/odoo/odoo/issues/32510Patch, Third Party Advisory
- https://github.com/odoo/odoo/issues/32510Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-14859?
How severe is CVE-2018-14859?
How do I fix CVE-2018-14859?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-14853A NULL pointer dereference in dhd_prot_txdata_write_flush in…
- CVE-2018-14854Buffer overflow in dhd_bus_flow_ring_delete_response in driv…
- CVE-2018-14855Buffer overflow in dhd_bus_flow_ring_flush_response in drive…
- CVE-2018-14856Buffer overflow in dhd_bus_flow_ring_create_response in driv…
- CVE-2018-14857Unrestricted file upload (with remote code execution) in req…
- CVE-2018-14858An SSRF vulnerability was discovered in idreamsoft iCMS befo…
- CVE-2018-14860Improper sanitization of dynamic user expressions in Odoo Co…
- CVE-2018-14861Improper data access control in Odoo Community 10.0 and 11.0…
- CVE-2018-14862Incorrect access control in the mail templating system in Od…
- CVE-2018-14863Incorrect access control in the RPC framework in Odoo Commun…
- CVE-2018-14864Incorrect access control in asset bundles in Odoo Community …
- CVE-2018-14865Report engine in Odoo Community 9.0 through 11.0 and earlier…
Are you affected by CVE-2018-14859?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST