CVE-2024-36259

NameCVE-2024-36259
DescriptionImproper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
odoo (PTS)bullseye (security), bullseye14.0.0+dfsg.2-7+deb11u2fixed
sid, trixie18.0.0+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
odoosourcebullseye(not affected)
odoosource(unstable)18.0.0+dfsg-1

Notes

[bullseye] - odoo <not-affected> (Only affects odoo 17.0)
https://github.com/odoo/odoo/issues/199330

Search for package or bug name: Reporting problems