Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets.
cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*
C5B912BD-1FB4-418A-9CE3-FBE0903D70BA
15.0
cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*
2BFAF5BD-20F9-402C-B7EB-4E0294A572AE
15.0
OR
# Security Advisory - [CVE-2021-23176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23176)

**Affects**: Odoo 15.0 and earlier (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-23176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23176)
**Component**: l10n_fr_fec
**Credits**: Florent Mirieu de la barre

Improper access control in reporting engine of l10n_fr_fec module in Odoo
Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows
remote authenticated users to extract accounting information via crafted
RPC packets.

## I.   Background

The l10n_fr_fec module is a module for the accounting localization of France
allowing to generate the Fichier d'Échange Informatisé (FEC).


## II.  Problem Description

The generation of the report was not properly protected and could be accessed
by users without accounting access rights.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: Employee / Portal user account required
**CVSS3 Score**: Medium :: 6.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Malicious users (including portal user accounts) on an Odoo database
might craft RPC requests specifically targeted at extracting accounting
data from the database.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

Until the deployment of the patch, the `l10n_fr_fec` module can be
uninstalled on unpatched database. Updating to the latest revision or
applying the corresponding patch is strongly recommended.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0: https://github.com/odoo/odoo/commit/0ef5489598e9ebfd430adb09c6c4038b926ad277
- 14.0: https://github.com/odoo/odoo/commit/f166400c7ddd1bc571fcad52d18d2371f2c3fd87
- 15.0: https://github.com/odoo/odoo/commit/66f0a384eeda7f223736e6e80b32b5c3e824653b
- 15.0-ent, 14.0-ent, 13.0-ent (Enterprise): see 15.0, 14.0 and 13.0.


[SEC] CVE-2021-23176 - Improper access control in reporting engine o...
This is a GitHub Issue
repo:odoo
owner:odoo
Title : [SEC] CVE-2021-23176 - Improper access control in reporting engine o...
Issue date:

--- start body ---
# Security Advisory - [CVE-2021-23176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23176)

**Affects**: Odoo 15.0 and earlier (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-23176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23176)
**Component**: l10n_fr_fec
**Credits**: Florent Mirieu de la barre

Improper access control in reporting engine of l10n_fr_fec module in Odoo
Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows
remote authenticated users to extract accounting information via crafted
RPC packets.

## I.   Background

The l10n_fr_fec module is a module for the accounting localization of France
allowing to generate the Fichier d'Échange Informatisé (FEC).


## II.  Problem Description

The generation of the report was not properly protected and could be accessed
by users without accounting access rights.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: Employee / Portal user account required
**CVSS3 Score**: Medium :: 6.5
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Malicious users (including portal user accounts) on an Odoo database
might craft RPC requests specifically targeted at extracting accounting
data from the database.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

Until the deployment of the patch, the `l10n_fr_fec` module can be
uninstalled on unpatched database. Updating to the latest revision or
applying the corresponding patch is strongly recommended.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0: https://github.com/odoo/odoo/commit/0ef5489598e9ebfd430adb09c6c4038b926ad277
- 14.0: https://github.com/odoo/odoo/commit/f166400c7ddd1bc571fcad52d18d2371f2c3fd87
- 15.0: https://github.com/odoo/odoo/commit/66f0a384eeda7f223736e6e80b32b5c3e824653b
- 15.0-ent, 14.0-ent, 13.0-ent (Enterprise): see 15.0, 14.0 and 13.0.


--- end body ---

comments :
--- start comments ---

--- end comments ---