CVE-2019-11784
Severity Score
6.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to.
Un control de acceso inapropiado en el módulo mail (notifications) en Odoo Community versiones 14.0 y anteriores y Odoo Enterprise versiones 14.0 y anteriores, permite a usuarios autenticados remotos conseguir acceso a mensajes arbitrarios en conversaciones en las que no eran parte
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-05-06 CVE Reserved
- 2020-12-22 CVE Published
- 2023-03-16 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-284: Improper Access Control
- CWE-862: Missing Authorization
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://github.com/odoo/odoo/issues/63709 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Odoo Search vendor "Odoo" | Odoo Search vendor "Odoo" for product "Odoo" | <= 14.0 Search vendor "Odoo" for product "Odoo" and version " <= 14.0" | community |
Affected
| ||||||
| Odoo Search vendor "Odoo" | Odoo Search vendor "Odoo" for product "Odoo" | <= 14.0 Search vendor "Odoo" for product "Odoo" and version " <= 14.0" | enterprise |
Affected
| ||||||