CVE-2018-14886 Path traversal in n/a
Privileged authenticated users can read local files via crafted module descriptions due to enabled RST local file inclusion.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-14886?
CVE-2018-14886 is a medium-severity path traversal vulnerability in Odoo Odoo, published on 28 Jun 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Weakness: CWE-732
Which versions are affected by CVE-2018-14886?
It affects 1 product.
Products include Odoo Odoo.
How do I fix CVE-2018-14886?
No fix has been published for CVE-2018-14886 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-14886 being exploited?
There is no known exploitation of CVE-2018-14886 in the wild and no public exploit code.
Other vulnerabilities in Odoo Odoo
Sources
Also known as GHSA-3h3h-vg74-fvqw.