VULNERABILITY INTELLIGENCE

CVE-2018-14860

CVSS score9.1 CRITICAL
EPSS probability2.21%
CISA KEVNot currently listed
Published2019-07-03
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Description

Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.

Weakness classification

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references