Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.
cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*
C3F9E8F1-FAF7-44AE-8D05-BE717D247EDE
cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*
167C709E-C8B2-4CCB-963E-E1D8C664190A
cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*
C52F2EEB-11E5-49E8-AD06-3014FF2C2D24
cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*
A4405E54-6C16-49D5-B632-3D72091B2FEB
cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*
38424B03-4121-4A79-8E4E-4CB4DCD3E4A5
cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*
1298CF62-A06E-48AD-8141-0541DE3F6381
OR
# Security Advisory - ODOO-SA-2018-08-07-9
 Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.

**Affects**: Odoo 9.0, 10.0, 11.0 (Community and Enterprise Editions)
**Component**: Core
**Credits**: Florent de Labarre
**CVE ID**: [CVE-2018-14866](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14866)


## I.   Background

The Odoo framework includes a mechanism for managing temporary records, known as
TransientModels, for the purpose of containing transient data while a certain
screen or operation is in progress. Such records are regularly deleted by a
garbage collector job.

The security model for regulating access to TransientModels is different from
regular non-transient ones, in that there are not customizable access rights.
A default, hardcoded security policy makes those transient records accessible
only to the user who created them (the owner), and to the administrator. 


## II.  Problem Description

The implementation of the security model for TransientModels was incomplete,
to the effect that some operations were possible by users on transient
records that they did not own.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: Unprivileged user account required
**CVSS3 Score**: Low :: 3.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

An attacker with an unprivileged user account (even portal users) may be able to
retrieve values of fields from transient records that they did not own, via
specially crafted RPC requests, in the interval between their creation and the
automatic garbage collection.
Such transient records may include limited business or sensitive data that
should not have been accessible to the attacker.

Exploitation would however be difficult in practice, limited by the need to
actually have TransientModels that include sensitive data (which depends on
installed modules), by the need to have a privileged user populate transient
records with the data, and by the need to execute the attack in the limited time
window before the automatic garbage collection.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is known, so applying the patch or updating is strongly
recommended.

Odoo Online servers have been patched as soon as the correction was
available.


## V.   Solution

Apply the patches corresponding to your Odoo installation, or update to
the latest revision, either via GitHub or by downloading it:
https://www.odoo.com/page/download

For the actual update procedure, please refer to our update instructions, valid
for all versions:
  https://www.odoo.com/documentation/11.0/setup/update.html

If you choose to apply the patch instead, change into the main directory of
your Odoo installation (the one containing "odoo" and "addons" directories),
then execute the patch command, typically:

       patch -p0 -f < /path/to/the_patch_file.patch
       
This command assumes your installation layout corresponds to
the latest source code layout of the Odoo project on GitHub.
If your installation differs, please extract the various patch
hunks from the files and apply them in the appropriate locations.


## VI.  Correction details

The following list contains the revisions after which the vulnerability
is corrected:

- 9.0:  67bf250ea5035e2e8e4da7e32f2671beb75cfab4
- 10.0: e93fa785629500e997330731d84853eb2edac299
- 11.0: 4b1b70a77a482926aa87503a8ef9d0aec5c5293f
- 11.0-ent, 10.0-ent and 9.0-ent (Enterprise): see 11.0, 10.0 and 9.0.

[SEC] ODOO-SA-2018-08-07-9 (CVE-2018-14866) - Incorrect access control in the...
This is a GitHub Issue
repo:odoo
owner:odoo
Title : [SEC] ODOO-SA-2018-08-07-9 (CVE-2018-14866) - Incorrect access control in the...
Issue date:

--- start body ---
# Security Advisory - ODOO-SA-2018-08-07-9
 Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.

**Affects**: Odoo 9.0, 10.0, 11.0 (Community and Enterprise Editions)
**Component**: Core
**Credits**: Florent de Labarre
**CVE ID**: [CVE-2018-14866](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14866)


## I.   Background

The Odoo framework includes a mechanism for managing temporary records, known as
TransientModels, for the purpose of containing transient data while a certain
screen or operation is in progress. Such records are regularly deleted by a
garbage collector job.

The security model for regulating access to TransientModels is different from
regular non-transient ones, in that there are not customizable access rights.
A default, hardcoded security policy makes those transient records accessible
only to the user who created them (the owner), and to the administrator. 


## II.  Problem Description

The implementation of the security model for TransientModels was incomplete,
to the effect that some operations were possible by users on transient
records that they did not own.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: Unprivileged user account required
**CVSS3 Score**: Low :: 3.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

An attacker with an unprivileged user account (even portal users) may be able to
retrieve values of fields from transient records that they did not own, via
specially crafted RPC requests, in the interval between their creation and the
automatic garbage collection.
Such transient records may include limited business or sensitive data that
should not have been accessible to the attacker.

Exploitation would however be difficult in practice, limited by the need to
actually have TransientModels that include sensitive data (which depends on
installed modules), by the need to have a privileged user populate transient
records with the data, and by the need to execute the attack in the limited time
window before the automatic garbage collection.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is known, so applying the patch or updating is strongly
recommended.

Odoo Online servers have been patched as soon as the correction was
available.


## V.   Solution

Apply the patches corresponding to your Odoo installation, or update to
the latest revision, either via GitHub or by downloading it:
https://www.odoo.com/page/download

For the actual update procedure, please refer to our update instructions, valid
for all versions:
  https://www.odoo.com/documentation/11.0/setup/update.html

If you choose to apply the patch instead, change into the main directory of
your Odoo installation (the one containing "odoo" and "addons" directories),
then execute the patch command, typically:

       patch -p0 -f < /path/to/the_patch_file.patch
       
This command assumes your installation layout corresponds to
the latest source code layout of the Odoo project on GitHub.
If your installation differs, please extract the various patch
hunks from the files and apply them in the appropriate locations.


## VI.  Correction details

The following list contains the revisions after which the vulnerability
is corrected:

- 9.0:  67bf250ea5035e2e8e4da7e32f2671beb75cfab4
- 10.0: e93fa785629500e997330731d84853eb2edac299
- 11.0: 4b1b70a77a482926aa87503a8ef9d0aec5c5293f
- 11.0-ent, 10.0-ent and 9.0-ent (Enterprise): see 11.0, 10.0 and 9.0.

--- end body ---

comments :
--- start comments ---

--- end comments ---