{"id":"CVE-2019-11781","state":"PUBLISHED","title":"Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their","description":"Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation.","publishedAt":"2020-12-22T16:25:35.000Z","updatedAt":"2024-08-04T23:03:32.878Z","severity":{"score":6.5,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"odoo"},"assigner":"odoo","products":["Odoo Odoo Community","Odoo Odoo Enterprise"],"affected":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"12.0","versionType":"custom"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"12.0","versionType":"custom"}]}],"references":["https://github.com/odoo/odoo/issues/63706"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T19:45:22.458Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/11xxx/CVE-2019-11781.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-11781","state":"PUBLISHED","datePublished":"2020-12-22T16:25:35.000Z","dateUpdated":"2024-08-04T23:03:32.878Z","assignerShortName":"odoo","assignerOrgId":"22c90092-d340-4fb8-a06e-f1193e012523","dateReserved":"2019-05-06T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation."}],"affected":[{"vendor":"Odoo","product":"Odoo Community","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"12.0","versionType":"custom"}]},{"vendor":"Odoo","product":"Odoo Enterprise","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"12.0","versionType":"custom"}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/63706","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"odoo","dateUpdated":"2020-12-22T16:25:35.000Z","orgId":"22c90092-d340-4fb8-a06e-f1193e012523"},"credits":[{"lang":"en","value":"\"iamsushi\""}],"source":{"advisory":"ODOO-SA-2020-12-02","discovery":"EXTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@odoo.com","ID":"CVE-2019-11781","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Odoo Community","version":{"version_data":[{"version_affected":"<=","version_value":"12.0"}]}},{"product_name":"Odoo Enterprise","version":{"version_data":[{"version_affected":"<=","version_value":"12.0"}]}}]},"vendor_name":"Odoo"}]}},"credit":[{"lang":"eng","value":"\"iamsushi\""}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-20 Improper Input Validation"}]}]},"references":{"reference_data":[{"name":"https://github.com/odoo/odoo/issues/63706","refsource":"MISC","url":"https://github.com/odoo/odoo/issues/63706"}]},"source":{"advisory":"ODOO-SA-2020-12-02","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/odoo/odoo/issues/63706","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T23:03:32.878Z"}}]}}}