CVE-2021-44775

What it actually does

The flaw permits unauthenticated remote injection of arbitrary JavaScript into web pages served by the Odoo Website application; when a victim loads the crafted page the script executes in the victim's browser context with the same origin as the Odoo instance.

Why it matters to the business

Successful exploitation can lead to theft of user sessions, unauthorized actions on behalf of authenticated users, and erosion of customer trust; because the vulnerability is more than three years old, has low exploit probability, and is not known to be used in ransomware or by advanced threat actors, immediate operational disruption risk remains low for most organizations.

How an attack unfolds

An attacker creates and posts content containing malicious script tags through the public website interface; any subsequent visitor who views the page triggers execution of the injected script in their browser, enabling theft of cookies or other client-side actions.

How to fix it

Upgrade Odoo Community and Enterprise installations to a version newer than 15.0 that contains the security fix; until upgrades are complete, restrict posting privileges to trusted users and apply web-application firewall rules that sanitize or block common script patterns in submitted content.

How to confirm the fix worked

After patching, attempt to post the same crafted content and confirm that script tags are stripped or escaped before rendering; review release notes for the applied Odoo version to verify inclusion of the Website-app XSS fix.

Typical attack path

1. Identify a publicly accessible Odoo Website page that accepts user-generated content
2. Craft and submit a post containing executable script payloads
3. Wait for or lure a victim user to view the affected page
4. Script executes in victim's browser, exfiltrating session data or performing actions

How to detect it

Search web-server access logs and Odoo application logs for POST requests containing HTML script, img onerror, or javascript: patterns directed at website content endpoints; inspect database records or content tables for stored payloads that include executable script tags.

• POST requests to /website/ or /web/content endpoints containing <script
• Content records containing javascript: or onerror= attributes
• Unexpected cookie exfiltration or fetch requests originating from website pages

What your security team should do

• Prioritize upgrade of all Odoo 15.0 and earlier instances to the latest supported release
• Audit public website pages for user-generated content that lacks output encoding
• Enable Content-Security-Policy headers that restrict inline script execution
• Monitor EPSS and KEV feeds for any future change in exploit activity