CVE-2024-21248 Details
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.22 and prior to 7.1.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L).
A vulnerability exists in the Oracle VM VirtualBox product within the Oracle Virtualization suite, specifically in the core component. This issue affects versions prior to 7.0.22 and prior to 7.1.2. The vulnerability is considered difficult to exploit but allows a low-privileged attacker with access to the environment where Oracle VM VirtualBox runs to compromise the application. Although the vulnerability is contained within Oracle VM VirtualBox, successful exploitation could significantly impact other products, indicating a scope change. Exploitation of this vulnerability could lead to unauthorized modification, addition, or deletion of certain data accessible to Oracle VM VirtualBox, as well as unauthorized reading of a subset of that data. Additionally, it could allow an attacker to cause a partial denial-of-service condition in Oracle VM VirtualBox.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 17, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.oracle.com/security-alerts/cpuoct2024.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| oracle vm virtualbox | >= 7.0.0, <= 7.0.22 >= 7.1.0, <= 7.1.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2025 | CVE Modified | CISA-ADP |
| Oct 18, 2024 | Initial Analysis | [email protected] |
| Oct 15, 2024 | New CVE Received | [email protected] |