CVE-2020-29396
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0,...
CVE-2020-29396 is a critical vulnerability (CVSS 9.9) in Odoo, published December 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.13%, the 88th percentile. Fixed in odoo 13.0.1.
- Severity
- 9.9 CriticalCVSS 3.0, CVE List
- Exploit chance
- 3.13%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
13.0.1odoo +5 more
Description
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
odooBitnami | 11.0.0 up to 13.0.1 | 13.0.1 |
odooUbuntu:22.04:LTS | All versions, plus listed versions 14.0.0+dfsg.2-714.0.0+dfsg.3-1 | None known |
odooUbuntu:24.04:LTS | All versions, plus listed versions 16.0.0+dfsg.1-316.0.0+dfsg.2-1.116.0.0+dfsg.2-2 | None known |
odooUbuntu:25.10 | All versions, plus listed versions 18.0.0+dfsg-2 | None known |
odooUbuntu:26.10 | All versions, plus listed versions 18.0.0+dfsg-2build119.0.0+dfsg-1 | None known |
odooUbuntu:26.04:LTS | All versions, plus listed versions 18.0.0+dfsg-218.0.0+dfsg-2build1 | None known |
What each source reports
CVE List Score used
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
- Record
CVE-2020-29396- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-267
- Updated
- 2026-11-02
EUVDEUVD-2020-21769
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
- Record
EUVD-2020-21769- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fg5r-c9qq-q3wm
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0,...
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
- Record
GHSA-fg5r-c9qq-q3wm- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
NVD
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
- Record
CVE-2020-29396- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-267
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-29396
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
- Record
UBUNTU-CVE-2020-29396- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVBIT-odoo-2020-29396No score
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
- Record
BIT-odoo-2020-29396- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.