CVE-2020-14629 : Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Published 2020-07-15 18:15:28

Updated 2021-02-19 18:51:34

Source Oracle

View at NVD, CVE.org

Vulnerability category: Bypass

Products affected by CVE-2020-14629

Oracle » Vm Virtualbox
Versions from including (>=) 6.1.0 and before (<) 6.1.12
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
Matching versions
Oracle » Vm Virtualbox
Versions from including (>=) 6.0.0 and before (<) 6.0.24
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
Matching versions
Oracle » Vm Virtualbox
Versions before (<) 5.2.44
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-14629

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 13 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-14629

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.9	MEDIUM	AV:L/AC:L/Au:N/C:C/I:N/A:N	3.9	6.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: None Availability Impact: None
6.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	1.5	4.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None
6.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	1.5	4.0	Oracle
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None

References for CVE-2020-14629

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html

[security-announce] openSUSE-SU-2020:1511-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpujul2020.html

Oracle Critical Patch Update Advisory - July 2020
Vendor Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html

[security-announce] openSUSE-SU-2020:1486-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.zerodayinitiative.com/advisories/ZDI-20-887/

ZDI-20-887 | Zero Day Initiative
Third Party Advisory;VDB Entry
https://security.gentoo.org/glsa/202101-09

VirtualBox: Multiple vulnerabilities (GLSA 202101-09) — Gentoo security
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-14629

Products affected by CVE-2020-14629

Exploit prediction scoring system (EPSS) score for CVE-2020-14629

CVSS scores for CVE-2020-14629

References for CVE-2020-14629