LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36383: Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demons...

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Xen Orchestra had an authorization flaw affecting xo-web through 5.80.0 and xo-server through 5.84.0. An attacker could improperly gain administrative-level access to sensitive areas such as VMs, backups, audits, users, and groups. The sources do not provide CVSS scoring, a confirmed patch note, or evidence of active exploitation.

Executive priority

Treat this as high priority for Xen Orchestra environments because it concerns administrative access to virtualization and backup data. Prioritize internet-reachable or broadly reachable consoles first. Do not claim confirmed exploitation from the supplied evidence.

Technical view

The CVE describes mishandled authorization in Xen Orchestra involving WebSocket resource-set authorization data. Tampering could cause permissions to be treated as admin instead of none, exposing management datasets. The source bundle names affected xo-web and xo-server version ceilings, but does not document prerequisites, fixed versions, or detailed remediation.

Likely exposure

Exposure is likely limited to organizations running Xen Orchestra with xo-web through 5.80.0 or xo-server through 5.84.0. Risk is higher where the Xen Orchestra interface is reachable beyond tightly controlled administrator networks. Authentication requirements are not stated in the provided sources.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of exploitation in the wild. The public description demonstrates authorization bypass through modified WebSocket data, but the provided evidence is incomplete on attacker prerequisites and practical exploitability.

Researcher notes

Key gaps remain: no CVSS, no CWE, no CPEs, no explicit fixed version, and no stated authentication prerequisite in the supplied bundle. Analysis should stay tied to the named affected version ceilings and the single public GitHub reference.

Mitigation direction

  • Check Vates/Xen Orchestra guidance for fixed releases or official remediation.
  • Update xo-web and xo-server beyond the affected version ceilings where vendor guidance supports it.
  • Restrict Xen Orchestra access to trusted administrative networks or VPN.
  • Review user, group, VM, backup, and audit access for unexpected permission changes.
  • Monitor the referenced GitHub issue and CVE record for remediation details.

Validation and detection

  • Inventory Xen Orchestra deployments and record xo-web and xo-server versions.
  • Confirm whether any deployment is at or below xo-web 5.80.0 or xo-server 5.84.0.
  • Review audit logs for unexpected access to VMs, backups, users, groups, or audit data.
  • Verify administrative access is limited to approved users and trusted network paths.
  • Recheck vendor and CVE records for updated fix information before closure.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-36383 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.