CVE-2019-11786

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify translated terms, which may lead to arbitrary content modification on translatable elements.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Odoo	Odoo Community	>= unspecified, <= 13.0
Odoo	Odoo Enterprise	>= unspecified, <= 13.0

References

https://github.com/odoo/odoo/issues/63711Third Party Advisory
https://github.com/odoo/odoo/issues/63711Third Party Advisory

Timeline

Published: Dec 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-11797.0An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory. An attacker who successfully expl CVE-2019-11807.0An elevation of privilege vulnerability exists in the way that the wcmsvc.dll handles objects in memory. An attacker who successfully exploi CVE-2019-118063.3OX App Suite 7.10.1 and earlier has Insecure Permissions.CVE-2019-118077.5The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachm CVE-2019-118083.7Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if a CVE-2019-118096.1An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a po CVE-2019-11819.8A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated atta CVE-2019-118107.5An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in meg CVE-2019-118117.0An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ip CVE-2019-118126.1A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discuss CVE-2019-118136.1An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attri CVE-2019-118146.1An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated