{"id":"CVE-2021-44460","state":"PUBLISHED","title":"Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated acc","description":"Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests.","publishedAt":"2023-04-25T18:33:33.360Z","updatedAt":"2024-08-04T04:25:16.420Z","severity":{"score":7.4,"label":"High","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"odoo"},"assigner":"odoo","products":["Odoo Odoo Community","Odoo Odoo Enterprise"],"affected":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"13.0","versionType":"semver"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"13.0","versionType":"semver"}]}],"references":["https://github.com/odoo/odoo/issues/107685"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T19:49:10.699Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/44xxx/CVE-2021-44460.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-44460","state":"PUBLISHED","datePublished":"2023-04-25T18:33:33.360Z","dateUpdated":"2024-08-04T04:25:16.420Z","assignerShortName":"odoo","assignerOrgId":"22c90092-d340-4fb8-a06e-f1193e012523","dateReserved":"2021-12-27T06:17:50.956Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests."}],"affected":[{"vendor":"Odoo","product":"Odoo Community","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"13.0","versionType":"semver"}]},{"vendor":"Odoo","product":"Odoo Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"13.0","versionType":"semver"}]}],"references":[{"url":"https://github.com/odoo/odoo/issues/107685"}],"metrics":[{"format":"CVSS","cvssV3_0":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"Improper Access Control","type":"CWE"}]}],"providerMetadata":{"shortName":"odoo","orgId":"22c90092-d340-4fb8-a06e-f1193e012523","dateUpdated":"2024-07-15T00:27:54.327Z"},"credits":[{"lang":"eng","value":"Xavier Morel","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-15T13:23:44.267561Z","id":"CVE-2021-44460","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-15T20:32:56.009Z"}},{"title":"CVE Program Container","references":[{"url":"https://github.com/odoo/odoo/issues/107685","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T04:25:16.420Z"}}]}}}