VYPR
← All advisories
High severity8.1NVD Advisory· Published Jul 3, 2019· Updated Jun 17, 2026

CVE-2018-14859

CVE-2018-14859

Description

Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • Odcms/Odoo6 versions
    cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*+ 5 more
    • cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*
    • cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*
    • cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*
    • cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*
  • Odoo/Odoo Enterprisedescription
  • Odcms/Enterprisellm-create
    Range: <=11.0
  • Odcms/Communityllm-create
    Range: <=11.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.