CVE-2021-45071 Cross-site scripting in Odoo Community

What is CVE-2021-45071?

CVE-2021-45071 is a medium-severity cross-site scripting vulnerability in Odoo Odoo, published on 25 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.

Weakness: CWE-79

Which versions are affected by CVE-2021-45071?

1 open source package ship an affected version, including odoo. It affects 1 product.

Products include Odoo Odoo.

How do I fix CVE-2021-45071?

Upgrade odoo to 15.0.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-45071 being exploited?

There is no known exploitation of CVE-2021-45071 in the wild and no public exploit code.

Other vulnerabilities in Odoo Odoo

• CVE-2020-29396 Code injection in Odoo Community Critical 9.9
• CVE-2018-14885 Auth bypass in n/a Critical 9.8
• CVE-2017-10804 Auth bypass in n/a Critical 9.8
• CVE-2018-14860 Code injection in n/a Critical 9.1
• CVE-2017-10805 Auth bypass in n/a High 8.8

All Odoo Odoo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-odoo-2021-45071, DEBIAN-CVE-2021-45071, GHSA-gqc6-9j5g-4r72, UBUNTU-CVE-2021-45071.