CVE-2021-36383: Incorrect Authorization

July 12, 2021 (updated July 12, 2022)

Xen Orchestra (with xo-web and xo-server ) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

References

github.com/vatesfr/xen-orchestra/issues/5712
nvd.nist.gov/vuln/detail/CVE-2021-36383

Detect and mitigate CVE-2021-36383 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →