vault backup: 2024-12-30 16:39:58
This commit is contained in:
7 files changed
+116
-6
No files matched your search
@@ -4,7 +4,7 @@ tags:
|
||||
---
|
||||
# CVE
|
||||
|
||||
Common Vulnerabilities and Exposures
|
||||
Common Vulnerabilities and Exposures.
|
||||
|
||||
## List
|
||||
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
# Odoo Security Advisory - ODOO-SA-2024-12-23
|
||||
|
||||
## [CVE-2024-12368](https://www.odoo.com/security-advisories/CVE-2024-12368.txt)
|
||||
|
||||
Affects: Odoo 15.0 (Community and Enterprise Editions)
|
||||
Severity :: High :: 8.1 :: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
||||
Databases with OAuth enabled are vulnerable to session hijacking by malicious
|
||||
internal users, limited to the users who are actually authenticated via OAuth.
|
||||
This exploit is only possible within the brief window of the OAuth token's
|
||||
validity, which is controlled by the OAuth provider. During this window
|
||||
a user could hijack the session of a more privileged user, resulting in a
|
||||
privilege escalation.
|
||||
|
||||
## [CVE-2024-36259](https://www.odoo.com/security-advisories/CVE-2024-36259.txt)
|
||||
|
||||
Affects: Odoo 17.0 (Community and Enterprise Editions)
|
||||
Severity :: High :: 7.5 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise
|
||||
17.0 allows remote authenticated attackers to extract sensitive information via
|
||||
an oracle-based (yes/no response) crafted attack.
|
||||
|
||||
## [CVE-2024-45840](https://www.odoo.com/security-advisories/CVE-2024-45840.txt)
|
||||
|
||||
Affects: Odoo 15.0 and earlier (Community and Enterprise Editions)
|
||||
Severity :: Medium :: 5.8 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
|
||||
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise
|
||||
15.0 and earlier allows remote authenticated users to download arbitrary server-
|
||||
side source code files.
|
||||
|
||||
## [CVE-2024-45681](https://www.odoo.com/security-advisories/CVE-2024-45681.txt)
|
||||
|
||||
Affects: Odoo 17.0 and earlier (Community and Enterprise Editions)
|
||||
Severity :: Critical :: 9.1 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
||||
Improper input validation in Odoo Community 17.0 and earlier and Odoo
|
||||
Enterprise version 17.0 and earlier may allow remote authenticated attackers to
|
||||
create arbitrary records via crafted RPC requests.
|
||||
|
||||
## [CVE-2024-36490](https://www.odoo.com/security-advisories/CVE-2024-36490.txt)
|
||||
|
||||
Affects: Odoo 16.0 (Community and Enterprise Editions)
|
||||
Severity :: High :: 8.1 :: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
||||
Improper access control in the mail template edition of Odoo Community 16.0 and
|
||||
Odoo Enterprise 16.0 allows internal users to escalate privileges.
|
||||
|
||||
## [CVE-2024-12865](https://www.odoo.com/security-advisories/CVE-2024-12865.txt)
|
||||
|
||||
Affects: Odoo 15.0 through 16.0 (Community and Enterprise Editions)
|
||||
Severity :: Medium :: 5.9 :: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
|
||||
Improper access control in Project App of Odoo Community 15.0 through 16.0
|
||||
and Odoo Enterprise 15.0 through 16.0 allows a portal user to alter the email
|
||||
address of other users.
|
||||
|
||||
## [CVE-2024-12887](https://www.odoo.com/security-advisories/CVE-2024-12887.txt)
|
||||
|
||||
Affects: Odoo 16.0 and later (Community and Enterprise Editions)
|
||||
Severity :: Medium :: 5.3 :: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
|
||||
Improper origin validation for WebSocket requests in Odoo Community 16.0 and
|
||||
later and Odoo Enterprise version 16.0 and later allows WebSocket cross-origin
|
||||
requests.
|
||||
|
||||
## [CVE-2024-49575](https://www.odoo.com/security-advisories/CVE-2024-49575.txt)
|
||||
|
||||
Affects: Odoo 16.0 and earlier (Community and Enterprise Editions)
|
||||
Severity :: Critical :: 9.1 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
||||
Improper input validation in OAuth module of Odoo Community 16.0 and earlier
|
||||
and Odoo Enterprise 16.0 and earlier allows an attacker authenticated via OAuth
|
||||
to escalate privileges by sending crafted HTTP requests.
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
lang: en
|
||||
---
|
||||
# Odoo Security Advisory
|
||||
|
||||
Responsible disclosure policy for Odoo security vulnerabilities.
|
||||
|
||||
Website: <https://www.odoo.com/de_DE/security-report>
|
||||
|
||||
The policy describes how security researcher can submit their findings and tells what the incident response procedure looks like.
|
||||
|
||||
Valid vulnerabilities receive a CVE (Common Vulnerabilities and Exposures) ID.
|
||||
|
||||
## Public Channels
|
||||
|
||||
CVEs are published on GitHub as issues: <https://github.com/odoo/odoo/issues?q=is%3Aissue+label%3ASecurity>.
|
||||
|
||||
## Notifications
|
||||
|
||||
Odoo notifies Odoo Enterprise customers with an on-premise installation of Odoo.
|
||||
|
||||
Here are CVEs addressed by mail from Odoo:
|
||||
|
||||
* [[Odoo Security Advisory - ODOO-SA-2024-12-23]]
|
||||
|
||||
+4
-2
@@ -7,7 +7,7 @@ tags:
|
||||
|
||||
Odoo verwaltet besonderns schützenswerte Daten und ist zugleich über das Internet erreichbar. Das setzt besondere Anforderungen an die Security voraus.
|
||||
|
||||
Für die Sicherheit der Software trägt [[Odoo S.A.]] die Verantwortung: <https://www.odoo.com/de_DE/security>
|
||||
Für die Sicherheit der Software trägt [[Odoo S.A.]] die Verantwortung: <https://www.odoo.com/de_DE/security>.
|
||||
|
||||
Für das Odoo-Hosting trägt die [[Mint System GmbH]] die Verantwortung.
|
||||
|
||||
@@ -25,4 +25,6 @@ Die Berechtigungsstrukturen in Odoo sind sehr strikt. Auch wenn ein Unbefugte Zu
|
||||
|
||||
**Sicherheitslücken**
|
||||
|
||||
Die Odoo Imgebung wird regelmässig aktualisiert. Dadurch werden die grössten [[OWASP-Sicherheitslücken]] mitigiert. Eine Ausführung dazu gibt es hier: <https://www.odoo.com/de_DE/security#owasp>
|
||||
Die Odoo Imgebung wird regelmässig aktualisiert. Dadurch werden die grössten [[OWASP-Sicherheitslücken]] mitigiert. Eine Ausführung dazu gibt es hier: <https://www.odoo.com/de_DE/security#owasp>.
|
||||
|
||||
Enterprise-Kunden werden über Sicherheitslücken über die [[Odoo Security Advisory]] benachrichtigt.
|
||||
@@ -0,0 +1,12 @@
|
||||
# Prozesse Sicherheit - Odoo Security Advisory
|
||||
|
||||
## Odoo Security Advisory verarbeiten
|
||||
|
||||
Auslöser: Odoo versende eine Mail mit einer [[Odoo Security Advisory]].
|
||||
|
||||
Arbeitsschritte:
|
||||
|
||||
* Die Liste der CVEs wird unter [[Odoo Security Advisory#Notifications]] festgehalten.
|
||||
* Es wird eine Liste von betroffenen Kunden erstellt.
|
||||
* Für die betroffenen Odoo Versionen wird eine neue Revision erstellt.
|
||||
* Das Revisions-Upgrade wird geplant.
|
||||
@@ -7,4 +7,5 @@ Dokumentation der Sicherheit-Prozesse.
|
||||
|
||||
Verantwortlich: [[Janik von Rotz]]
|
||||
|
||||
* [[Prozess Sicherheit - Assessment]]
|
||||
* [[Prozess Sicherheit - Assessment]]
|
||||
* [[Prozesse Sicherheit - Odoo Security Advisory]]
|
||||
+5
-2
@@ -1,10 +1,13 @@
|
||||
---
|
||||
tags:
|
||||
- Asset
|
||||
- Asset
|
||||
lang: en
|
||||
---
|
||||
# Security
|
||||
|
||||
Themen:
|
||||
Security is a practice. It is not something that can be bought or out sourced. A good security is cumulative result of protecting an organisation and system against common threats and vulnerabilities. The playing field of attackers and defense is ever changing. There is no such thing as 100% secure.
|
||||
|
||||
Topics:
|
||||
|
||||
* [[Web Application Firewall]]
|
||||
* [[Zugriffskontrolle]]
|
||||
|
||||
Reference in new issue
Block a user