CVE-2021-23203

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284CWE-863

Affected software

VendorProductVersions
OdooOdoo Community>= 14.0, <= 15.0
OdooOdoo Enterprise>= 14.0, <= 15.0

References

Timeline

Published
Apr 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-232046.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be eCVE-2021-232058.1Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers CVE-2021-232067.8A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code CVE-2021-232075.5An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi ViCVE-2021-232094.8Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated MobileCVE-2021-23216.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is PrioCVE-2021-232105.5A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted CVE-2021-232114.4Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption keyCVE-2021-232148.1When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle aCVE-2021-232155.5An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could CVE-2021-232177.5NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to inCVE-2021-232187.5When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a
CVE-2021-23203: High severity, CVSS 7.5 | Vulnix