// For flags

CVE-2024-21248

Oracle VirtualBox Shared Folders Incorrect Authorization Local Privilege Escalation Vulnerability

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.22 and prior to 7.1.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L).

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability.
The specific flaw exists within the implementation of Shared Folders. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the current user on the host system.

*Credits: Anonymous
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-12-07 CVE Reserved
  • 2024-10-15 CVE Published
  • 2024-10-17 CVE Updated
  • 2024-10-21 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://www.oracle.com/security-alerts/cpuoct2024.html 2024-10-15
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle Corporation
Search vendor "Oracle Corporation"
 Oracle VM VirtualBox
Search vendor "Oracle Corporation" for product "Oracle VM VirtualBox"
 < 7.0.22
Search vendor "Oracle Corporation" for product "Oracle VM VirtualBox" and version " < 7.0.22"
en
Affected
Oracle Corporation
Search vendor "Oracle Corporation"
 Oracle VM VirtualBox
Search vendor "Oracle Corporation" for product "Oracle VM VirtualBox"
 < 7.1.2
Search vendor "Oracle Corporation" for product "Oracle VM VirtualBox" and version " < 7.1.2"
en
Affected