Description

Odoo is a suite of business management software

Odoo DB manager is designed to be accessed by high privileged users only. It's not recommended to have Odoo DB manager publicly accessible even with enabled 'Masted Password'.

Remediation

Restrict access to Odoo DB manager

References

Odoo Help: securing /web/database/manager

Databases administration

Related Vulnerabilities

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-14820)

Apache balancer-manager application publicly accessible

[Possible] Password Transmitted over Query String

Vanilla Forums Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-10073)

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-0837)

Severity

High

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Insecure Admin Access