What’s Vulnerable › Vulnerabilities

CVE-2021-36383

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-07-12 · updated 2026-06-17

Description

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

Affected products

• Xen-Orchestra Xo-Server: through 5.84.0
• Xen-Orchestra Xo-Web: through 5.80.0

References

• https://github.com/vatesfr/xen-orchestra/issues/5712
• https://github.com/vatesfr/xen-orchestra/issues/5712

Get alerted when CVE-2021-36383 or the next vulnerability affects your stack