CVE-2021-45071

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Odoo	Odoo Community	<= 15.0
Odoo	Odoo Enterprise	<= 15.0

References

https://github.com/odoo/odoo/issues/107697Issue Tracking, Patch, Vendor Advisory
https://www.debian.org/security/2023/dsa-5399
https://github.com/odoo/odoo/issues/107697Issue Tracking, Patch, Vendor Advisory
https://www.debian.org/security/2023/dsa-5399

Timeline

Published: Apr 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-450745.4JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known use CVE-2021-450777.5Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated CVE-2021-450787.8stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) o CVE-2021-450799.1In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (CVE-2021-450815.9An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.CVE-2021-450827.8An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to im CVE-2021-450837.1An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive informa CVE-2021-450856.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a CVE-2021-450866.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name val CVE-2021-450876.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by CVE-2021-450886.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.CVE-2021-450895.2Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.