CVE-2021-44547 Code injection in Odoo Community
Authenticated administrators can execute arbitrary code due to a sandboxing flaw, leading to privilege escalation in Odoo.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44547?
CVE-2021-44547 is a high-severity code injection vulnerability in Odoo Odoo, published on 25 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.
Weakness: CWE-267
Which versions are affected by CVE-2021-44547?
1 open source package ship an affected version, including odoo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
odoo Bitnami | All versions | 15.0.1 |
Products include Odoo Odoo.
How do I fix CVE-2021-44547?
Upgrade odoo to 15.0.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-44547 being exploited?
There is no known exploitation of CVE-2021-44547 in the wild and no public exploit code.
Other vulnerabilities in Odoo Odoo
Sources
Also known as BIT-odoo-2021-44547, GHSA-6pv9-8vp3-8q9q, UBUNTU-CVE-2021-44547.