medium4.3
CVE-2021-36383
Xen Orchestra Mishandles Authorization
Impact
Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket `resourceSet.getAll` data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | xo-web | <= 5.80.0 | none recorded |
| npm | xo-server | <= 5.84.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xen-Orchestra | Xo-Server | through 5.84.0 |
| Xen-Orchestra | Xo-Web | through 5.80.0 |