CVE-2018-15641: 
NixOS vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in the web module of Odoo Community and Enterprise editions versions 11.0 through 14.0. The vulnerability, identified as CVE-2018-15641, was disclosed on December 22, 2020. The issue allows remote authenticated internal users to inject arbitrary web script in the browser of a victim through crafted calendar event attributes (NVD, GitHub Issue).

The vulnerability stems from a programming error in the calendar view component that causes improper input sanitization of calendar event attributes. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Odoo's own assessment rated it slightly higher at 6.3 (Medium) with the vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

If exploited, this vulnerability could lead to privilege escalation and execution of actions using the session of another user. The attack requires an attacker with an Employee/Internal user account to craft a special calendar event and trick another user into viewing it, potentially allowing the execution of arbitrary web script in the victim's browser (GitHub Issue).

The vulnerability is network exploitable and requires authentication with an 'Employee' user account. User interaction is required for successful exploitation as the victim needs to view the crafted calendar event. Odoo S.A. reported no known instances of this vulnerability being exploited in the wild (GitHub Issue).

The vulnerability was patched in multiple versions with the following revision numbers: 11.0: 3f06c22, 12.0: 7a54f8a, 13.0: 8f094a1, and 14.0: 2876991. No workarounds were available, and applying the patches was strongly recommended. Odoo Cloud servers were patched immediately upon correction availability (GitHub Issue).