Oracle Corporation VM VirtualBox
En bref
- Source
- NVD
- EPSS
- EPSS 2.14 % · centile 82 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- oracle
- Statut NVD
- Modified
Rechercher sur…
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Faiblesses (CWE)
- CWE-306 — Authentification absente sur une fonction critique
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | oracle |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · secalert_us@oracle.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2022-41870
- GCVE · GCVE-0-2022-39425
Avis du CERT-FR
- CERTFR-2022-AVI-934 — Multiples vulnérabilités dans Oracle Virtualization · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*< 6.1.40
Produits affectés
| Produit | Versions |
|---|---|
| Oracle Corporation · VM VirtualBox | affected unspecified < 6.1.40 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |