CVE-2021-36383

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-363859.8A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fu CVE-2021-363867.5report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mai CVE-2021-363875.4In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specia CVE-2021-363887.5In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulner CVE-2021-363897.5In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability CVE-2021-36396.1A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate p CVE-2021-363929.8In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.CVE-2021-363939.8In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.CVE-2021-363949.8In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.CVE-2021-363957.5In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.CVE-2021-363967.5In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a b CVE-2021-363975.3In Moodle, insufficient capability checks meant message deletions were not limited to the current user.