What is CVE-2021-44465?

CVE-2021-44465 is a medium-severity vulnerability in Odoo, classified under Improper Access Control. CVSS score: 4.3/10. Published 2023-04-25.

How severe is CVE-2021-44465?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2021-44465 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Odoo

CVE-2021-44465

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests.

EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Odoo
Odoo Community — versions 0
Odoo Enterprise — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security@odoo.com (Patch, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2021-44465?: CVE-2021-44465 is a medium-severity vulnerability in Odoo, classified under Improper Access Control. CVSS score: 4.3/10. Published 2023-04-25.
How severe is CVE-2021-44465?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2021-44465 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.