Oracle VM VirtualBox Vulnerability Allows Low Privileged Attackers to Compromise Virtual Machine Data
CVE-2024-21108

3.3LOW

Key Information:

Vendor

Oracle
Status
Vm Virtualbox
Vendor
CVE Published:
16 April 2024

What is CVE-2024-21108?

A vulnerability exists in Oracle VM VirtualBox, specifically within the Core component, which can be exploited by a low privileged attacker with logon access to the host where Oracle VM VirtualBox is running. If successfully exploited, this vulnerability can lead to unauthorized read access to sensitive data accessible within the Oracle VM VirtualBox environment. The issue is present in versions prior to 7.0.16, emphasizing the need for users to update to the most recent version to mitigate potential risks.

Affected Version(s)

VM VirtualBox * < 7.0.16

References

https://www.oracle.com/security-alerts/cpuapr2024.html
vendor-advisory

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2024-21108 : Oracle VM VirtualBox Vulnerability Allows Low Privileged Attackers to Compromise Virtual Machine Data