CVE-2019-11781 Cross-site request forgery in Odoo Community
Remote attackers can trick victims into modifying their accounts via crafted links, leading to privilege escalation in Odoo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-11781?
CVE-2019-11781 is a medium-severity vulnerability in Odoo Odoo, published on 22 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation.
Weakness: CWE-20
Which versions are affected by CVE-2019-11781?
It affects 1 product.
Products include Odoo Odoo.
How do I fix CVE-2019-11781?
No fix has been published for CVE-2019-11781 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11781 being exploited?
There is no known exploitation of CVE-2019-11781 in the wild and no public exploit code.
Other vulnerabilities in Odoo Odoo
Sources
Also known as GHSA-8qww-xfxc-2wmf.