CVE-2019-11784 Missing authorization in Odoo Community
Remote authenticated users can access arbitrary messages in conversations they were not a party to due to improper access control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11784?
CVE-2019-11784 is a medium-severity missing authorization vulnerability in Odoo Odoo, published on 22 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to.
Which versions are affected by CVE-2019-11784?
It affects 1 product.
Products include Odoo Odoo.
How do I fix CVE-2019-11784?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-11784 being exploited?
There is no known exploitation of CVE-2019-11784 in the wild and no public exploit code.
Other vulnerabilities in Odoo Odoo
Sources
Also known as DEBIAN-CVE-2019-11784, GHSA-9rp8-hcmg-4f3f.