CVE-2017-10804

9.8 CRITICAL
Published: July 04, 2017 Modified: May 13, 2026
View on NVD

Description

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3
Source: cve@mitre.org
Release Notes
https://github.com/odoo/odoo/issues/17914
Source: cve@mitre.org
Patch Third Party Advisory
https://github.com/psycopg/psycopg2/issues/420
Source: cve@mitre.org
Exploit Third Party Advisory
http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
https://github.com/odoo/odoo/issues/17914
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Third Party Advisory
https://github.com/psycopg/psycopg2/issues/420
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory

6 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.8 / 10.0
EPSS (Exploit Probability)
3.4%
87th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-306

Affected Vendors

odoo

Related CVEs

CVE-2026-48777 N/A
CVE-2026-47750 7.8
CVE-2026-47747 7.8
CVE-2026-46448 5.4
CVE-2026-22313 9.1