CVE-2022-21295

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).

CVSS v3 3.8 LOW
CVSS v2.0 2.1 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.oracle.com/security-alerts/cpujan2022.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

History

22 Jan 2022, 03:25

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
References	~~(MISC) https://www.oracle.com/security-alerts/cpujan2022.html -~~	(MISC) https://www.oracle.com/security-alerts/cpujan2022.html - Vendor Advisory
First Time		Oracle vm Virtualbox Oracle
CVSS	v2 : ~~unknown~~ v3 : ~~3.8~~	v2 : 2.1 v3 : 3.8
CPE		cpe:2.3:a:oracle:vm_virtualbox::::::::

19 Jan 2022, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-01-19 12:15

Updated : 2023-12-10 14:09

NVD link : CVE-2022-21295

Mitre link : CVE-2022-21295

CVE.ORG link : CVE-2022-21295

JSON object : View

Products Affected

oracle

vm_virtualbox

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-21295", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.0}]}, "published": "2022-01-19T12:15:12.540", "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2022.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)."}, {"lang": "es", "value": "Una vulnerabilidad en el producto Oracle VM VirtualBox de Oracle Virtualization (componente: Core). La versi\u00f3n compatible que est\u00e1 afectada es anterior a la 6.1.32. Una vulnerabilidad explotable f\u00e1cilmente, permite a un atacante con bajos privilegios y con acceso a la infraestructura en la que es ejecutado Oracle VM VirtualBox, comprometer a Oracle VM VirtualBox. Mientras que la vulnerabilidad est\u00e1 en Oracle VM VirtualBox, los ataques pueden afectar significativamente a otros productos. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en un acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle VM VirtualBox. Nota: Esta vulnerabilidad es aplicada \u00fanicamente a los sistemas Windows. CVSS 3.1, Puntuaci\u00f3n base 3.8 (impactos en la Confidencialidad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)"}], "lastModified": "2022-01-22T03:25:34.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91A2A4B0-88FC-41D1-8719-4FAABED19F8E", "versionEndExcluding": "6.1.32"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}