GitHub Advisoryadvisory · npm

GHSA-grvm-gcqf-gh8q Xen Orchestra Mishandles Authorization

MEDIUM Published 2022-05-24 Modified 2023-10-19 Official page ↗
Aliases
CVE-2021-36383
Ecosystem
npm
Packages
xo-web, xo-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2023-10-19

Affected packages

• npm xo-web: <= 5.80.0 (no fix yet) • npm xo-server: <= 5.84.0 (no fix yet)

Description

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket `resourceSet.getAll` data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

Related

Alias · CVE (1)

  • CVE-2021-36383 Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References