CVE-2024-36259
Published: 25 February 2025
Summary
CVE-2024-36259 is a high-severity Improper Access Control (CWE-284) vulnerability in Odoo Odoo. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-36259 is an improper access control vulnerability (CWE-284) affecting the mail module in Odoo Community 17.0 and Odoo Enterprise 17.0. Published on 2025-02-25, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability effects.
Remote authenticated attackers can exploit this vulnerability to extract sensitive information via an oracle-based crafted attack that relies on yes/no responses.
Further details on mitigation, including potential patches or workarounds, are available in the referenced advisory at https://github.com/odoo/odoo/issues/199330.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53931
Vulnerability details
Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables exploitation for privilege escalation (T1068) via crafted RPC search queries with elevated privileges and facilitates collection of sensitive data from the mail messaging repository (T1213.005) using an oracle-based yes/no response mechanism for information extraction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to information and system resources, directly countering the improper access control in Odoo's mail module that enables sensitive information extraction.
Applies least privilege to limit authenticated users' access to only necessary resources, reducing the potential for oracle-based extraction of unauthorized sensitive data.
Provides for timely identification, reporting, and correction of the specific flaw in Odoo 17.0 mail module referenced in the advisory.