Servers and applications
CVE-2017-10804
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.
- Severity
- Critical 9.8
- Published
- 4 Jul 2017
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 3.4% in the next 30 daysHigher than 89% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Missing authentication (CWE-306)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
OdooServers and applications · cpe:a:odoo:odoo |
|