{"api_version":"1","generated_at":"2026-07-23T15:32:16+00:00","cve":"CVE-2018-15638","urls":{"html":"https://cve.report/CVE-2018-15638","api":"https://cve.report/api/cve/CVE-2018-15638.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-15638","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-15638"},"summary":{"title":"CVE-2018-15638","description":"Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.","state":"PUBLIC","assigner":"security@odoo.com","published_at":"2020-12-22 17:15:00","updated_at":"2020-12-22 19:46:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://github.com/odoo/odoo/issues/63703","name":"https://github.com/odoo/odoo/issues/63703","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"[SEC] CVE-2018-15638 - Affects: Odoo 13.0 and earlier (Community an... · Issue #63703 · odoo/odoo · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15638","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15638","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Subash SN and Bharath Kumar (Appsecco)","lang":""},{"source":"LEGACY","value":"Dipanshu Agrawal","lang":""}],"nvd_cpes":[{"cve_year":"2018","cve_id":"15638","vulnerable":"1","versionEndIncluding":"13.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"odoo","cpe5":"odoo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"15638","vulnerable":"1","versionEndIncluding":"13.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"odoo","cpe5":"odoo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2018-15638","ASSIGNER":"security@odoo.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Odoo Community","version":{"version_data":[{"version_affected":"<=","version_value":"13.0"}]}},{"product_name":"Odoo Enterprise","version":{"version_data":[{"version_affected":"<=","version_value":"13.0"}]}}]},"vendor_name":"Odoo"}]}},"credit":[{"lang":"eng","value":"Subash SN and Bharath Kumar (Appsecco)"},{"lang":"eng","value":"Dipanshu Agrawal"}],"description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":" CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://github.com/odoo/odoo/issues/63703","name":"https://github.com/odoo/odoo/issues/63703"}]},"source":{"advisory":"ODOO-SA-2020-12-02","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2020-12-22 17:15:00","lastModifiedDate":"2020-12-22 19:46:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*","versionEndIncluding":"13.0","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"13.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"15638","Ordinal":"132415","Title":"CVE-2018-15638","CVE":"CVE-2018-15638","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"15638","Ordinal":"1","NoteData":"Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"15638","Ordinal":"2","NoteData":"2020-12-22","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"15638","Ordinal":"3","NoteData":"2020-12-22","Type":"Other","Title":"Modified"}]}}}