CVE-2017-10804
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances beca…
Published Jul 4, 2017 · updated Jun 16, 2026 · odoo odoo
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.
Timeline
Detection, updates, and resolution for this record.
Jul 4, 2017 · Catalog
Detected
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.
Jun 16, 2026 · Catalog
Updated
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.
Affected
- cpe odoo/odoo10.0
- cpe odoo/odoo8.0
- cpe odoo/odoo9.0
Sources
- CVE.orgCVE-2017-10804
Official CVE identifier
cve.org - NIST NVDCVE-2017-10804
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because P
nvd.nist.gov - Odoo SecurityCVE-2017-10804
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com