CVE-2021-36383

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data…

published July 12, 2021

CVSS
—
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00714 · 53.2th percentile
Published
2021-07-12T13:18Z
EPSS history
Timeline
  • 12 JUL 13:18Z
    Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data…
    cvelistv5