VULNERABILITY INTELLIGENCE

CVE-2018-14868

CVSS score6.5 MEDIUM
EPSS probability0.60%
CISA KEVNot currently listed
Published2019-06-28
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.

Weakness classification

  • CWE-287: Improper Authentication

Primary references