PT-2021-21263 · Unknown · Xen Orchestra

R3Naissance · Published 2021-07-12 · Updated 2022-07-12 · CVE-2021-36383

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen Orchestra versions through 5.80.0 (xo-web) and through 5.84.0 (xo-server)

Description The issue concerns mishandled authorization. An attacker can modify WebSocket resourceSet.getAll data, changing the permission field from none to admin, thereby gaining access to sensitive data sets including VMs, Backups, Audit, Users, and Groups.

Recommendations For versions through 5.80.0 (xo-web) and through 5.84.0 (xo-server), as a temporary workaround, consider restricting access to the resourceSet.getAll WebSocket endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-36383

GHSA-GRVM-GCQF-GH8Q

Affected Products

Xen Orchestra

References · 5

• 🔥 https://github.com/vatesfr/xen-orchestra/issues/5712 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-36383 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36383 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-grvm-gcqf-gh8q · Vendor Advisory
• https://github.com/vatesfr/xen-orchestra · Note