Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*
C5B912BD-1FB4-418A-9CE3-FBE0903D70BA
15.0
cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*
2BFAF5BD-20F9-402C-B7EB-4E0294A572AE
15.0
OR
# Security Advisory - [CVE-2021-44775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44775)

**Affects**: Odoo 15.0 and earlier (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-44775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44775)
**Component**: Website
**Credits**: Holger Brunn (Therp BV)

Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and
earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to
inject arbitrary web script in the browser of a victim, by posting crafted
contents.

## I.   Background

Iframes can be inserted into a website page via the website editor. This allows
to embed external content such as videos into a forum question.


## II.  Problem Description

Improper content validation allowed to inject arbitrary web script code in the
iframe definition that would be executed by the visitor of the page.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: User account required (including portal users)
**CVSS3 Score**: Medium :: 6.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

An attacker might insert malicious code into a page that will be executed by
another user visiting the page.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is available, updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0: https://github.com/odoo/odoo/commit/384d67b9736787be96c834f2bf28bf935d610b10
- 14.0: https://github.com/odoo/odoo/commit/74532a0839b57337cc26ffc66b2884039e68f23b
- 15.0: https://github.com/odoo/odoo/commit/88ab30b970cf55b35555b693d714765fb3e9081d
- 15.0-ent, 14.0-ent, 13.0-ent (Enterprise): see 15.0, 14.0 and 13.0.


[SEC] CVE-2021-44775 - Cross-site scripting (XSS) issue in Website a...
This is a GitHub Issue
repo:odoo
owner:odoo
Title : [SEC] CVE-2021-44775 - Cross-site scripting (XSS) issue in Website a...
Issue date:

--- start body ---
# Security Advisory - [CVE-2021-44775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44775)

**Affects**: Odoo 15.0 and earlier (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-44775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44775)
**Component**: Website
**Credits**: Holger Brunn (Therp BV)

Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and
earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to
inject arbitrary web script in the browser of a victim, by posting crafted
contents.

## I.   Background

Iframes can be inserted into a website page via the website editor. This allows
to embed external content such as videos into a forum question.


## II.  Problem Description

Improper content validation allowed to inject arbitrary web script code in the
iframe definition that would be executed by the visitor of the page.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: User account required (including portal users)
**CVSS3 Score**: Medium :: 6.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

An attacker might insert malicious code into a page that will be executed by
another user visiting the page.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is available, updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0: https://github.com/odoo/odoo/commit/384d67b9736787be96c834f2bf28bf935d610b10
- 14.0: https://github.com/odoo/odoo/commit/74532a0839b57337cc26ffc66b2884039e68f23b
- 15.0: https://github.com/odoo/odoo/commit/88ab30b970cf55b35555b693d714765fb3e9081d
- 15.0-ent, 14.0-ent, 13.0-ent (Enterprise): see 15.0, 14.0 and 13.0.


--- end body ---

comments :
--- start comments ---

--- end comments ---