CVE-2017-10804
 
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.
En Odoo versión 8.0, Odoo Community Edition versiones 9.0 y 10.0, y Odoo Community Edition versiones 9.0 y 10.0, los atacantes remotos pueden omitir la identificación bajo ciertas circunstancias porque los parámetros que contienen caracteres 0x00 están truncados antes de alcanzar la capa de base de datos. Esto ocurre porque es usado Psycopg versión 2.x anterior a 2.6.3.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-07-03 CVE Reserved
- 2017-07-04 CVE Published
- 2023-05-08 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3 | Release Notes |
URL | Date | SRC |
---|---|---|
https://github.com/psycopg/psycopg2/issues/420 | 2024-08-05 |
URL | Date | SRC |
---|---|---|
https://github.com/odoo/odoo/issues/17914 | 2017-07-12 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Odoo Search vendor "Odoo" | Odoo Search vendor "Odoo" for product "Odoo" | 8.0 Search vendor "Odoo" for product "Odoo" and version "8.0" | - |
Affected
| ||||||
Odoo Search vendor "Odoo" | Odoo Search vendor "Odoo" for product "Odoo" | 9.0 Search vendor "Odoo" for product "Odoo" and version "9.0" | community |
Affected
| ||||||
Odoo Search vendor "Odoo" | Odoo Search vendor "Odoo" for product "Odoo" | 9.0 Search vendor "Odoo" for product "Odoo" and version "9.0" | enterprise |
Affected
| ||||||
Odoo Search vendor "Odoo" | Odoo Search vendor "Odoo" for product "Odoo" | 10.0 Search vendor "Odoo" for product "Odoo" and version "10.0" | community |
Affected
| ||||||
Odoo Search vendor "Odoo" | Odoo Search vendor "Odoo" for product "Odoo" | 10.0 Search vendor "Odoo" for product "Odoo" and version "10.0" | enterprise |
Affected
|