Approved changes feed: RSS · Atom
cpe:2.3:a:xen-orchestra:xo-server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Xen Orchestra (c361aa7b-3f80-5610-b05c-987f624face8) |
|---|---|
| Product | Xo Server (b049b4cc-96ce-57c7-90c0-452bbe89c4c3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/vatesfr/xen-orchestra |
purl2cpe | 2026-06-01 10:16:08.189280 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-36383 |
vulnerable | 2026-06-08 05:32:52.181604 |
Details available
Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.
Published: 2021-07-12T13:18:48.000Z
Updated: 2024-08-04T00:54:51.428Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.