Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim.
cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*
D3FA7C86-7FC1-4310-9945-EE9265577C5D
15.0
13.0
OR
# Security Advisory - [CVE-2021-44461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44461)

**Affects**: Odoo 13.0 to 15.0 (Enterprise Edition)
**CVE ID**: [CVE-2021-44461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44461)
**Component**: Accounting (account_accountant)

Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0
through 15.0, allows remote attackers who are able to control the contents
of accounting journal entries to inject arbitrary web script in the browser
of a victim.


## I.   Background

The Odoo accounting application allows external users to send invoices by email
that are automatically imported into an Odoo database.


## II.  Problem Description

The content of the invoice was not properly sanitized.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: None
**CVSS3 Score**: Medium :: 6.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

A malicious user could send a crafted invoice and trigger injected web script
code when an accountant opens the invoice.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is available, updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0-ent: https://github.com/odoo/enterprise/commit/eb6799b56c0f4f55a91c59efc750abc6b9aa1436
- 14.0-ent: https://github.com/odoo/enterprise/commit/48f48647e3d9b61778450e430e889eb362d0e5d3
- 15.0-ent: https://github.com/odoo/enterprise/commit/fce7a1a52e7e30e5adcdd61d49a512f27e08f73f


[SEC] CVE-2021-44461 - Cross-site scripting (XSS) issue in Accountin...
This is a GitHub Issue
repo:odoo
owner:odoo
Title : [SEC] CVE-2021-44461 - Cross-site scripting (XSS) issue in Accountin...
Issue date:

--- start body ---
# Security Advisory - [CVE-2021-44461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44461)

**Affects**: Odoo 13.0 to 15.0 (Enterprise Edition)
**CVE ID**: [CVE-2021-44461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44461)
**Component**: Accounting (account_accountant)

Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0
through 15.0, allows remote attackers who are able to control the contents
of accounting journal entries to inject arbitrary web script in the browser
of a victim.


## I.   Background

The Odoo accounting application allows external users to send invoices by email
that are automatically imported into an Odoo database.


## II.  Problem Description

The content of the invoice was not properly sanitized.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: None
**CVSS3 Score**: Medium :: 6.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

A malicious user could send a crafted invoice and trigger injected web script
code when an accountant opens the invoice.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

No workaround is available, updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0-ent: https://github.com/odoo/enterprise/commit/eb6799b56c0f4f55a91c59efc750abc6b9aa1436
- 14.0-ent: https://github.com/odoo/enterprise/commit/48f48647e3d9b61778450e430e889eb362d0e5d3
- 15.0-ent: https://github.com/odoo/enterprise/commit/fce7a1a52e7e30e5adcdd61d49a512f27e08f73f


--- end body ---

comments :
--- start comments ---

--- end comments ---