Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
cpe:2.3:a:odoo:odoo:14.0:*:*:*:community:*:*:*
4D952E47-04E1-4146-A3AA-3804A1AB52DA
cpe:2.3:a:odoo:odoo:14.0:*:*:*:enterprise:*:*:*
BEB5354F-C1AC-48D6-8922-656F952442A1
cpe:2.3:a:odoo:odoo:15.0:*:*:*:community:*:*:*
EBD0BABD-16C5-449D-8BE7-9E948A509FA5
cpe:2.3:a:odoo:odoo:15.0:*:*:*:enterprise:*:*:*
24A23452-4857-4F4B-AA5A-944F9073A554
OR
# Security Advisory - [CVE-2021-26263](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26263)

**Affects**: Odoo 14.0 and 15.0 (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-26263](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26263)
**Component**: Discuss
**Credits**: Theodoros Malachias, iamsushi, Ranjit Pahan

Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0
through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote
attackers to inject arbitrary web script in the browser of a victim,
by posting crafted contents.

## I.   Background

Odoo has a live chat feature to discuss in real time with employees or website
visitors. A notification is triggered when a new message is received.

## II.  Problem Description

Improper input validation allowed to inject arbitrary code executed in the
browser of the viction when the message is received.

## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: None
**CVSS3 Score**: High :: 7.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

An attacker might craft requests to send arbitrary code to a victim and execute
web script without needing active interaction from the victim, other than being
connected. This may lead to privilege escalation and sensitive information
disclosure.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is available, updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 14.0: https://github.com/odoo/odoo/commit/ff1db4a6aea522cf3dfc80ca88e64ffecfb5e07c
- 15.0: https://github.com/odoo/odoo/commit/41e7d26a751cf56f70afef314acae220bee464bc
- 15.0-ent, 14.0-ent (Enterprise): see 15.0 and 14.0.

[SEC] CVE-2021-26263 - Cross-site scripting (XSS) issue in Discuss a...
This is a GitHub Issue
repo:odoo
owner:odoo
Title : [SEC] CVE-2021-26263 - Cross-site scripting (XSS) issue in Discuss a...
Issue date:

--- start body ---
# Security Advisory - [CVE-2021-26263](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26263)

**Affects**: Odoo 14.0 and 15.0 (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-26263](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26263)
**Component**: Discuss
**Credits**: Theodoros Malachias, iamsushi, Ranjit Pahan

Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0
through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote
attackers to inject arbitrary web script in the browser of a victim,
by posting crafted contents.

## I.   Background

Odoo has a live chat feature to discuss in real time with employees or website
visitors. A notification is triggered when a new message is received.

## II.  Problem Description

Improper input validation allowed to inject arbitrary code executed in the
browser of the viction when the message is received.

## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: None
**CVSS3 Score**: High :: 7.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

An attacker might craft requests to send arbitrary code to a victim and execute
web script without needing active interaction from the victim, other than being
connected. This may lead to privilege escalation and sensitive information
disclosure.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is available, updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 14.0: https://github.com/odoo/odoo/commit/ff1db4a6aea522cf3dfc80ca88e64ffecfb5e07c
- 15.0: https://github.com/odoo/odoo/commit/41e7d26a751cf56f70afef314acae220bee464bc
- 15.0-ent, 14.0-ent (Enterprise): see 15.0 and 14.0.

--- end body ---

comments :
--- start comments ---

--- end comments ---