CVE-2024-21109
Oracle VirtualBox Web Service Exposure of Resource to Wrong Sphere Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerabilidad en el producto Oracle VM VirtualBox de Oracle Virtualization (componente: Core). Las versiones compatibles que se ven afectadas son anteriores a la 7.0.16. Una vulnerabilidad difícil de explotar permite que un atacante no autenticado con acceso a la red a través de HTTP comprometa Oracle VM VirtualBox. Los ataques exitosos a esta vulnerabilidad pueden resultar en un acceso no autorizado a datos críticos o un acceso completo a todos los datos accesibles de Oracle VM VirtualBox. CVSS 3.1 Puntaje base 5.9 (Impactos en la confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Oracle VirtualBox. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the vboxwebsrv service. The issue results from the exposure of a resource to the wrong control sphere. An attacker can leverage this vulnerability to disclose sensitive session information, leading to further compromise.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2023-12-07 CVE Reserved
- 2024-04-16 CVE Published
- 2024-05-26 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.oracle.com/security-alerts/cpuapr2024.html | 2024-04-17 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Oracle Corporation Search vendor "Oracle Corporation" | VM VirtualBox Search vendor "Oracle Corporation" for product "VM VirtualBox" | < 7.0.16 Search vendor "Oracle Corporation" for product "VM VirtualBox" and version " < 7.0.16" | en |
Affected
|