Security readout for executives and security teams
Plain-English summary
CVE-2021-44775 is a cross-site scripting issue in the Odoo Website app affecting Odoo Community and Enterprise 15.0 and earlier. An unauthenticated remote attacker could post crafted content that runs script in a victim’s browser. Business impact is mainly integrity risk, including page tampering or actions performed through a targeted user’s session.
Executive priority
Treat as a moderate-priority web application fix. It is not described as actively exploited in the supplied evidence, but public Odoo Website deployments should be patched promptly because the bug can affect content integrity and trusted user sessions.
Technical view
The CVE describes CWE-79 XSS in Odoo Website. CVSS 3.0 is 6.5: network reachable, low complexity, no privileges required, user interaction required, unchanged scope, high integrity impact, no confidentiality or availability impact. The supplied sources do not provide exploit details, confirmed active exploitation, or complete fixed-version metadata.
Likely exposure
Exposure is most likely where Odoo Community or Enterprise 15.0 or earlier runs the Website app and permits posted content from untrusted or semi-trusted users. Internet-facing public websites increase likelihood of attempted abuse.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires a victim to view or interact with attacker-posted content, so risk depends on content-posting workflows and user roles exposed through the Website app.
Researcher notes
The main evidence gap is fixed-version detail: the CVE description states 15.0 and earlier, while the structured affected data in the bundle is not useful for precise version scoping. Avoid assuming exploit availability or broader Odoo module impact beyond Website.
Mitigation direction
- Identify Odoo Community and Enterprise instances running version 15.0 or earlier.
- Check Odoo guidance and the referenced GitHub issue for fixed release details.
- Apply relevant Odoo or Debian security updates where applicable.
- Limit untrusted posting in the Website app until patched.
- Prioritize public-facing Odoo websites over internal-only deployments.
Validation and detection
- Inventory Odoo versions and confirm whether the Website app is enabled.
- Review whether anonymous or untrusted users can post website content.
- Confirm installed packages include fixes from Odoo or Debian advisories.
- Check web logs for unusual content-posting activity around public pages.
- Review stored website content for unexpected script-bearing markup.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-44775 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.5MediumVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/odoo/odoo/issues/107691CVE reference
- https://www.debian.org/security/2023/dsa-5399CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.