Lucene search
GoogleOSV:GHSA-GRVM-GCQF-GH8QHistoryMay 24, 2022 - 7:07 p.m.
Xen Orchestra Mishandles Authorization
2022-05-2419:07:30
Google
osv.dev
7
xen orchestra
authorization mishandle
websocket vulnerability
data access
Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.
Related
cvelist
cvelist
CVE-2021-36383
2021-07-12 13:18:48
github
github
Xen Orchestra Mishandles Authorization
2022-05-24 19:07:30
nvd
nvd
CVE-2021-36383
2021-07-12 14:15:11
cve
cve
CVE-2021-36383
2021-07-12 14:15:11
prion
prion
Authorization
2021-07-12 14:15:00