CVE-2021-26947 Cross-site scripting in Odoo Community

What is CVE-2021-26947?

CVE-2021-26947 is a medium-severity cross-site scripting vulnerability in Odoo Odoo, published on 25 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.

Weakness: CWE-79

Which versions are affected by CVE-2021-26947?

1 open source package ship an affected version, including odoo. It affects 1 product.

Products include Odoo Odoo.

How do I fix CVE-2021-26947?

Upgrade odoo to 15.0.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-26947 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-26947 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Odoo Odoo

• CVE-2020-29396 Code injection in Odoo Community Critical 9.9
• CVE-2018-14885 Auth bypass in n/a Critical 9.8
• CVE-2017-10804 Auth bypass in n/a Critical 9.8
• CVE-2018-14860 Code injection in n/a Critical 9.1
• CVE-2017-10805 Auth bypass in n/a High 8.8

All Odoo Odoo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-odoo-2021-26947, DEBIAN-CVE-2021-26947, GHSA-73p2-3xgj-j397, UBUNTU-CVE-2021-26947.