CVE-2021-44476 Path traversal in Odoo Community

What is CVE-2021-44476?

CVE-2021-44476 is a medium-severity path traversal vulnerability in Odoo Odoo, published on 25 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.

Weakness: CWE-267

Which versions are affected by CVE-2021-44476?

1 open source package ship an affected version, including odoo. It affects 1 product.

Products include Odoo Odoo.

How do I fix CVE-2021-44476?

Upgrade odoo to 15.0.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-44476 being exploited?

There is no known exploitation of CVE-2021-44476 in the wild and no public exploit code.

Other vulnerabilities in Odoo Odoo

• CVE-2020-29396 Code injection in Odoo Community Critical 9.9
• CVE-2018-14885 Auth bypass in n/a Critical 9.8
• CVE-2017-10804 Auth bypass in n/a Critical 9.8
• CVE-2018-14860 Code injection in n/a Critical 9.1
• CVE-2017-10805 Auth bypass in n/a High 8.8

All Odoo Odoo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-odoo-2021-44476, DEBIAN-CVE-2021-44476, GHSA-9pr4-h436-c9w9, UBUNTU-CVE-2021-44476.