Vulnerability CVE-2019-2555


Published: 2019-01-16

Description:
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Type:

CWE-284

(Improper Access Control)

Vendor: Oracle
Product: Vm virtualbox 
Version:
6.0.0
5.2.8
5.2.6
5.2.4
5.2.22
5.2.20
5.2.18
5.2.16
5.2.14
5.2.12
5.2.10
5.2.0
5.1.8
5.1.6
5.1.4
5.1.38
5.1.36
5.1.34
5.1.32
5.1.30
5.1.28
5.1.26
5.1.24
5.1.22
5.1.20
5.1.2
5.1.18
5.1.16
5.1.14
5.1.12
5.1.10
5.1.0
5.0.36
5.0.32
5.0.26
5.0.24
5.0.20
5.0.18
5.0.16
5.0.14
5.0.13
5.0.12
5.0.10
4.3.8
4.3.6
4.3.4
4.3.36
4.3.35
4.3.34
4.3.29
4.3.2
4.3.18
4.3.14
4.3.12
4.3.10
4.3.0
4.2.8
4.2.6
4.2.4
4.2.36
4.2.34
4.2.31
4.2.26
4.2.24
4.2.22
4.2.20
4.2.2
4.2.18
4.2.16
4.2.14
4.2.12
4.2.10
4.2.0
4.1.8
4.1.6
4.1.44
4.1.42
4.1.4
4.1.39
4.1.34
4.1.32
4.1.30
4.1.28
4.1.26
4.1.24
4.1.22
4.1.20
4.1.2
4.1.18
4.1.16
4.1.14
4.1.12
4.1.10
4.1.0
4.0.8
4.0.6
4.0.4
4.0.36
4.0.34
4.0.31
See more versions on NVD

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
http://www.securityfocus.com/bid/106568

Related CVE
CVE-2018-12023
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provid...
CVE-2019-2556
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2554
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2553
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2552
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2550
Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Logoff Page). The supported version that is affected is 12.0.2. Easily exploitable vulnerability allows unauthenticated attacker wi...
CVE-2019-2549
Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Logoff Page). The supported version that is affected is 12.0.2. Easily exploitable vulnerability allows unauthenticated attacker wi...
CVE-2019-2548
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon...

Copyright 2019, cxsecurity.com

 

Back to Top