CVE-2018-15634: 
NixOS vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability identified as CVE-2018-15634 affects Odoo Community 14.0 and earlier versions, as well as Odoo Enterprise 14.0 and earlier versions. The vulnerability was discovered by Nathanael ROTA (Capgemini) and Alessandro Innocenti, and it resides in the attachment management functionality of the system (GitHub Issue).

The vulnerability stems from improper control of attachment attributes in the system's file attachment functionality, which allows files to be attached directly to any database record. This is distinct from a previous vulnerability (CVE-2018-15633). The vulnerability has been assigned a CVSS v3.0 score of 7.1 (High) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N, indicating network exploitability with no authentication required (GitHub Issue).

The vulnerability allows remote attackers to execute arbitrary web scripts in a victim's browser through specially crafted URLs. If successfully exploited, this could lead to privilege escalation and unauthorized execution of actions using the victim's session. At the time of disclosure, Odoo S.A. reported no known exploitation of this vulnerability in the wild (GitHub Issue).

The attack vector is network-based and requires no user authentication. However, successful exploitation requires user interaction, as the victim needs to be tricked into visiting a specially crafted URL link (GitHub Issue).

No workarounds were available for this vulnerability. The recommended solution was to apply security patches or upgrade to the latest version. The vulnerability was fixed in specific revisions: 11.0 (2c1f39a), 12.0 (4aeb006), 13.0 (1fefdda), and 14.0 (88e5d2d). Odoo Cloud servers were patched immediately upon correction availability (GitHub Issue).