{"id":"CVE-2018-15634","state":"PUBLISHED","title":"Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web s","description":"Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.","publishedAt":"2020-12-22T16:25:33.000Z","updatedAt":"2024-08-05T10:01:54.274Z","severity":{"score":7.1,"label":"High","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","source":"odoo"},"assigner":"odoo","products":["Odoo Odoo Community","Odoo Odoo Enterprise"],"affected":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"14.0","versionType":"custom"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"14.0","versionType":"custom"}]}],"references":["https://github.com/odoo/odoo/issues/63702"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:44:22.805Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2018/15xxx/CVE-2018-15634.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2018-15634","state":"PUBLISHED","datePublished":"2020-12-22T16:25:33.000Z","dateUpdated":"2024-08-05T10:01:54.274Z","assignerShortName":"odoo","assignerOrgId":"22c90092-d340-4fb8-a06e-f1193e012523","dateReserved":"2018-08-21T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link."}],"affected":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"14.0","versionType":"custom"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"14.0","versionType":"custom"}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63702","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"odoo","dateUpdated":"2020-12-22T16:25:33.000Z","orgId":"22c90092-d340-4fb8-a06e-f1193e012523"},"credits":[{"lang":"en","value":"Nathanael ROTA (Capgemini)"},{"lang":"en","value":"Alessandro Innocenti"}],"source":{"advisory":"ODOO-SA-2020-12-02","discovery":"EXTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@odoo.com","ID":"CVE-2018-15634","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Odoo Community","version":{"version_data":[{"version_affected":"<=","version_value":"14.0"}]}},{"product_name":"Odoo Enterprise","version":{"version_data":[{"version_affected":"<=","version_value":"14.0"}]}}]},"vendor_name":"Odoo"}]}},"credit":[{"lang":"eng","value":"Nathanael ROTA (Capgemini)"},{"lang":"eng","value":"Alessandro Innocenti"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://github.com/odoo/odoo/issues/63702","refsource":"MISC","url":"https://github.com/odoo/odoo/issues/63702"}]},"source":{"advisory":"ODOO-SA-2020-12-02","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/odoo/odoo/issues/63702","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T10:01:54.274Z"}}]}}}