Exposição de Odoo
CMS22
score de exposição
9.041
sites usam
0
em exploração
1
críticos
Análise Vexday
O histórico de vulnerabilidades do Odoo reúne 34 CVEs catalogadas, com taxa de exploração ativa abaixo da média geral do catálogo KEV — nenhuma das falhas registradas consta atualmente como explorada ativamente pela CISA. A falha mais crítica em evidência, CVE-2018-15640, apresenta EPSS de aproximadamente 0,079, indicando probabilidade baixa a moderada de exploração em curto prazo, e está associada ao padrão de controle de acesso inadequado (CWE-284), que é justamente o tipo de fraqueza mais recorrente no portfólio de vulnerabilidades da plataforma. A ausência de novas CVEs nos últimos 90 dias e a existência de apenas uma falha de severidade crítica sugerem superfície de ataque relativamente estável no período recente, embora controles de autorização devam receber atenção prioritária em revisões de segurança, dado o padrão de falha dominante.
CVEs
34 resultadosCVE-2018-15640HIGHImproper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated prEPSS 7.8%CVE-2020-29396CRITICALA sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows EPSS 3.2%CVE-2019-11780HIGHImproper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authentEPSS 2.1%CVE-2019-11781MEDIUMImproper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackeEPSS 2.1%CVE-2019-11785MEDIUMImproper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote auEPSS 1.5%CVE-2019-11782MEDIUMImproper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with acceEPSS 1.4%CVE-2021-26947MEDIUMCross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbEPSS 1.4%CVE-2018-15631MEDIUMImproper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticaEPSS 1.4%CVE-2018-15632HIGHImproper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote EPSS 1.2%CVE-2018-15635MEDIUMCross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remoteEPSS 1.0%CVE-2019-11783MEDIUMImproper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows reEPSS 1.0%CVE-2019-11784MEDIUMImproper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remotEPSS 1.0%CVE-2018-15634HIGHCross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows reEPSS 0.9%CVE-2018-15633HIGHCross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remoteEPSS 0.9%CVE-2021-23203HIGHImproper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackEPSS 0.9%CVE-2018-15645HIGHImproper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticatEPSS 0.9%CVE-2021-45111HIGHImproper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to triggerEPSS 0.8%CVE-2021-23176MEDIUMImproper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier alEPSS 0.8%CVE-2018-15641MEDIUMCross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authEPSS 0.7%CVE-2021-44547HIGHA sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading tEPSS 0.7%