CVE-2021-45111 Missing authorization in Odoo Community
Authenticated users can create demonstration data with known credentials, potentially leading to unauthorized access or privilege escalation in Odoo.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45111?
CVE-2021-45111 is a high-severity missing authorization vulnerability in Odoo Odoo, published on 25 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials.
Weakness: CWE-284
Which versions are affected by CVE-2021-45111?
1 open source package ship an affected version, including odoo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
odoo Bitnami | All versions | 15.0.1 |
Products include Odoo Odoo.
How do I fix CVE-2021-45111?
Upgrade odoo to 15.0.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-45111 being exploited?
There is no known exploitation of CVE-2021-45111 in the wild and no public exploit code.
Other vulnerabilities in Odoo Odoo
Sources
Also known as BIT-odoo-2021-45111, DEBIAN-CVE-2021-45111, GHSA-wf33-pghc-9qmj, UBUNTU-CVE-2021-45111.