CVE-2021-45111

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Odoo	Odoo Community	<= 15.0
Odoo	Odoo Enterprise	<= 15.0

References

https://github.com/odoo/odoo/issues/107683Issue Tracking, Patch, Vendor Advisory
https://www.debian.org/security/2023/dsa-5399
https://github.com/odoo/odoo/issues/107683Issue Tracking, Patch, Vendor Advisory
https://www.debian.org/security/2023/dsa-5399

Timeline

Published: Apr 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-451157.5An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred sign CVE-2021-451167.5An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language CVE-2021-451176.5The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.CVE-2021-452228.8An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privi CVE-2021-452236.5An issue was discovered in COINS Construction Cloud 11.12. Due to insufficient input neutralization, it is vulnerable to denial of service a CVE-2021-452246.1An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a U CVE-2021-452256.1An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization, it is vulnerable to reflected cross-site sc CVE-2021-452266.5An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause i CVE-2021-452275.4An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionalit CVE-2021-452285.4An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task CVE-2021-452296.1It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affec CVE-2021-452306.5In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create D