Odoo Security Fix Timeline

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the _updateSettings function. This makes it possible for unauthenticated at…

Odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an or…

Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.

Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Oodo Content-Type Cross-Site Scripting

Insecure Content-Type validation Cross-Site Scripting in Oodo

Odoo · Odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstrat…

Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the br…

Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary we…

Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.

A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, inclu…

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notificat…

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC req…

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

[IMP] web: StaticList: support SET (6) orm command

Modules: web

[IMP] web: StaticList: support SET (6) orm command Before this commit, `_applyCommands` didn't support SET command (command 6). As a consequence, this command had to be special-cased in `_preprocessX2manyChanges`, and in an override of `Record` in the ai_fields addon [1]. With this commit, the SET command is now supported in `_applyCommands`, and a `set()` function has been added on StaticList for convenience. Note: since [2], onchange no longer returns SET commands (it only returns commands from 0 to 4). So this commit adapts a historical test that still simulated an onchange returning a SET command as first command. No task, but followup of [3] [1] https://github.com/odoo-dev/enterprise/blob/366f0376644d4aecd239378782d2db896ea7bf9f/ai_fields/static/src/model/relational_model/record.js#L26 [2] https://github.com/odoo/odoo/pull/119510 [3] https://github.com/odoo/enterprise/pull/830…

[IMP] web: StaticList: support CLEAR (5) orm command

Modules: web

[IMP] web: StaticList: support CLEAR (5) orm command Before this commit, the StaticList didn't expose a way to apply a CLEAR command (command 5), i.e. to empty the relation. This commit adds a `clear()` function to do so, and adds the support of the CLEAR command in `_applyCommands`. Note: since [1], onchange no longer returns CLEAR commands (it only returns commands from 0 to 4). So this commit adapts a few historical tests that still simulated onchanges returning a CLEAR command as first command. Request for task~5350021 [1] https://github.com/odoo/odoo/pull/119510 Part-of: odoo/odoo#249054 Related: odoo/enterprise#107694

[REF] web_tour: prepare to change the default action in tour_compiler

Modules: account, mail, point_of_sale, pos_hr, pos_restaurant, pos_self_order, project, purchase_product_matrix

[REF] web_tour: prepare to change the default action in tour_compiler Currently, in tour_compiler, to check that an element is actually present in the DOM in a step, there are 2 possibilities. - `isCheck: true` => Checks that the element is in the DOM. The latter can be disabled. - `run() {}` => Checks that the element is in the DOM (because this is what is done by default). However, if the element is disabled, the step will be aborted. In the codebase, we can see a lot of `run() {} //it's a check` and `isCheck:true`. However, the behavior is not exactly the same. What's more, there are 2 ways to do "the same thing". In order to clarify the turns API, it was decided to no longer put an action (step.run) by default. (Previously, the default action was the "click" action). From then on, it is no longer necessary to stipulate `step.isCheck: true` nor `run() {}`. The corollary is that now…

[IMP] payment stripe: migrate to a direct payment flow

Modules: payment, payment_stripe, sale

[IMP] payment stripe: migrate to a direct payment flow The Reserve Bank of India (RBI) issued a directive (amended subsequently in December 2020 and March 2021) that introduces additional security measures for recurring payments on India-issued cards. These measures include: - Banks must register cardholders and create an e-mandate through a one-time process, using additional factor authentication (AFA) like 3D Secure (3DS). - Banks must alert cardholders at least 24 hours before charges take place and give them the ability to opt out of transactions. - Recurring transactions over 15,000 INR (or equivalent in other currencies) must go through AFA each time. Stripe has worked with a partner platform to support that, but we must manipulate the PaymentIntent and SetupIntent objects directly through their dedicated API, which the Checkout API does not allow. Therefore, we must now…

[FIX] reqs: bump up recommended `requests` version

[FIX] reqs: bump up recommended `requests` version In light of CVE-2018-18074, using python-requests 2.20.0 is recommended, or any distribution-specific version that was patched. See also https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074