CVE-2021-23166 - Vulnerability Details - OpenCVE

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00337.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Odoo	Odoo

Configuration 1 [-]

OR	cpe:2.3:a:odoo:odoo:::::community:::*
	cpe:2.3:a:odoo:odoo:::::enterprise:::*

No data.

No data.

Advisories

Source	ID	Title
Debian DSA	DSA-5399-1	odoo security update
EUVD	EUVD-2021-10276	A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/odoo/odoo/issues/107687
https://www.debian.org/security/2023/dsa-5399

History

Mon, 03 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-276
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: odoo

Published: 2023-04-25T18:33:35.417Z

Updated: 2025-02-03T17:19:21.242Z

Reserved: 2021-12-27T06:17:50.974Z

Link: CVE-2021-23166

Vulnrichment

Updated: 2024-08-03T19:05:55.305Z

NVD

Status : Modified

Published: 2023-04-25T19:15:09.140

Modified: 2025-02-03T18:15:26.993

Link: CVE-2021-23166

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-23166", "assignerOrgId": "22c90092-d340-4fb8-a06e-f1193e012523", "state": "PUBLISHED", "assignerShortName": "odoo", "dateReserved": "2021-12-27T06:17:50.974Z", "datePublished": "2023-04-25T18:33:35.417Z", "dateUpdated": "2025-02-03T17:19:21.242Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "22c90092-d340-4fb8-a06e-f1193e012523", "shortName": "odoo", "dateUpdated": "2024-07-15T00:27:54.327Z"}, "affected": [{"vendor": "Odoo", "product": "Odoo Community", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "15.0", "versionType": "semver"}]}, {"vendor": "Odoo", "product": "Odoo Enterprise", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "15.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server."}], "references": [{"url": "https://github.com/odoo/odoo/issues/107687"}, {"url": "https://www.debian.org/security/2023/dsa-5399"}], "metrics": [{"format": "CVSS", "cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-267", "description": "Privilege Defined With Unsafe Actions", "type": "CWE"}]}], "credits": [{"lang": "eng", "value": "Nils Hamerlinck", "type": "finder"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:05:55.305Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/odoo/odoo/issues/107687", "tags": ["x_transferred"]}, {"url": "https://www.debian.org/security/2023/dsa-5399", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-276", "lang": "en", "description": "CWE-276 Incorrect Default Permissions"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-03T17:16:56.975334Z", "id": "CVE-2021-23166", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T17:19:21.242Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/odoo/odoo/issues/107687", "tags": ["x_transferred"]}, {"url": "https://www.debian.org/security/2023/dsa-5399", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:05:55.305Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-23166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-03T17:16:56.975334Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T17:19:15.000Z"}}], "cna": {"credits": [{"lang": "eng", "type": "finder", "value": "Nils Hamerlinck"}], "metrics": [{"format": "CVSS", "cvssV3_0": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Odoo", "product": "Odoo Community", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "15.0"}], "defaultStatus": "unaffected"}, {"vendor": "Odoo", "product": "Odoo Enterprise", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "15.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/odoo/odoo/issues/107687"}, {"url": "https://www.debian.org/security/2023/dsa-5399"}], "descriptions": [{"lang": "en", "value": "A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-267", "description": "Privilege Defined With Unsafe Actions"}]}], "providerMetadata": {"orgId": "22c90092-d340-4fb8-a06e-f1193e012523", "shortName": "odoo", "dateUpdated": "2024-07-15T00:27:54.327Z"}}}, "cveMetadata": {"cveId": "CVE-2021-23166", "state": "PUBLISHED", "dateUpdated": "2025-02-03T17:19:21.242Z", "dateReserved": "2021-12-27T06:17:50.974Z", "assignerOrgId": "22c90092-d340-4fb8-a06e-f1193e012523", "datePublished": "2023-04-25T18:33:35.417Z", "assignerShortName": "odoo"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*", "matchCriteriaId": "C5B912BD-1FB4-418A-9CE3-FBE0903D70BA", "versionEndIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2BFAF5BD-20F9-402C-B7EB-4E0294A572AE", "versionEndIncluding": "15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server."}], "id": "CVE-2021-23166", "lastModified": "2025-02-03T18:15:26.993", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security@odoo.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-04-25T19:15:09.140", "references": [{"source": "security@odoo.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/odoo/odoo/issues/107687"}, {"source": "security@odoo.com", "url": "https://www.debian.org/security/2023/dsa-5399"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/odoo/odoo/issues/107687"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2023/dsa-5399"}], "sourceIdentifier": "security@odoo.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-267"}], "source": "security@odoo.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-276"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}