{"id":"CVE-2021-26263","state":"PUBLISHED","title":"Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script i","description":"Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.","publishedAt":"2023-04-25T18:33:40.613Z","updatedAt":"2024-08-03T20:19:20.148Z","severity":{"score":7.5,"label":"High","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"odoo"},"assigner":"odoo","products":["Odoo Odoo Community","Odoo Odoo Enterprise"],"affected":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThanOrEqual":"15.0","versionType":"semver"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThanOrEqual":"15.0","versionType":"semver"}]}],"references":["https://github.com/odoo/odoo/issues/107693","https://www.debian.org/security/2023/dsa-5399"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:48:13.210Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/26xxx/CVE-2021-26263.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-26263","state":"PUBLISHED","datePublished":"2023-04-25T18:33:40.613Z","dateUpdated":"2024-08-03T20:19:20.148Z","assignerShortName":"odoo","assignerOrgId":"22c90092-d340-4fb8-a06e-f1193e012523","dateReserved":"2021-07-20T14:28:12.183Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents."}],"affected":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThanOrEqual":"15.0","versionType":"semver"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThanOrEqual":"15.0","versionType":"semver"}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107693"},{"url":"https://www.debian.org/security/2023/dsa-5399"}],"metrics":[{"format":"CVSS","cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Cross-site Scripting (XSS)","type":"CWE"}]}],"providerMetadata":{"shortName":"odoo","orgId":"22c90092-d340-4fb8-a06e-f1193e012523","dateUpdated":"2024-07-15T00:27:54.327Z"},"credits":[{"lang":"eng","value":"Theodoros Malachias","type":"finder"},{"lang":"eng","value":"iamsushi","type":"finder"},{"lang":"eng","value":"Ranjit Pahan","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"odoo","product":"odoo_community","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThanOrEqual":"15.0","versionType":"custom"}],"cpes":["cpe:2.3:a:odoo:odoo_community:14.0:*:*:*:*:*:*:*"]},{"vendor":"odoo","product":"odoo_enterprise","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThanOrEqual":"15.0","versionType":"custom"}],"cpes":["cpe:2.3:a:odoo:odoo_enterprise:14.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-15T14:49:47.368802Z","id":"CVE-2021-26263","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-15T14:56:17.565Z"}},{"title":"CVE Program Container","references":[{"url":"https://github.com/odoo/odoo/issues/107693","tags":["x_transferred"]},{"url":"https://www.debian.org/security/2023/dsa-5399","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:19:20.148Z"}}]}}}