CVE-2020-29396 json
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows…
published 5y ago modified last mo. also BIT-odoo-2020-29396 , EUVD-2020-21769
- cvss
- 9.9
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
Patch / fix
- bitnami odoo 13.0.1
- github.com/odoo/odoo/issues/63712 advisory
- oracle.com/security-alerts/cpujul2022.html advisory
Is CVE-2020-29396 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
3.13% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| OSV | 3.0 | 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | odoo | >=11.0.0, <13.0.1 |
13.0.1 |
Affected products
- Odoo Odoo Community
- Odoo Odoo Enterprise
Classification
- Weakness
-
- CWE-267 Privilege Defined With Unsafe Actions
References
-
github.com
/odoo/odoo/issues/63712
patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpujul2022.html
patch, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-29396
web
Sources
- CVE List CVE-2020-29396
- NVD CVE-2020-29396
- OSV BIT-odoo-2020-29396
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.