Описание
Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.
Ссылки
- PatchThird Party Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*
cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*
cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*
cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*
EPSS
Процентиль: 57%
0.00348
Низкий
8.1 High
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-284
Связанные уязвимости
CVSS3: 8.1
debian
больше 6 лет назад
Incorrect access control in the password reset component in Odoo Commu ...
CVSS3: 8.1
github
больше 3 лет назад
Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.
EPSS
Процентиль: 57%
0.00348
Низкий
8.1 High
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-284