ByteOS Network

Vulnerability Details :

CVE-2022-21487

Assigner-oracle

Assigner Org ID-43595867-4340-4103-b7a2-9a5208d29a85

Published At-19 Apr, 2022 | 20:38

Updated At-24 Sep, 2024 | 20:06

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:oracle

Assigner Org ID:43595867-4340-4103-b7a2-9a5208d29a85

Published At:19 Apr, 2022 | 20:38

Updated At:24 Sep, 2024 | 20:06

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Oracle Corporation

Product

VM VirtualBox

Versions

Affected

From unspecified before 6.1.34 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data.

Type: text

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data.

Metrics

Version	Base score	Base severity	Vector
3.1	3.8	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Version: 3.1

Base score: 3.8

Base severity: LOW

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
https://security.gentoo.org/glsa/202208-36	vendor-advisory x_refsource_GENTOO

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2022.html

Resource:

x_refsource_MISC

Hyperlink: https://security.gentoo.org/glsa/202208-36

Resource:

vendor-advisory

x_refsource_GENTOO

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC x_transferred
https://security.gentoo.org/glsa/202208-36	vendor-advisory x_refsource_GENTOO x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2022.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202208-36

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:19 Apr, 2022 | 21:15

Updated At:22 Sep, 2022 | 20:53

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	3.8	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 3.8

Base severity: LOW

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Type: Primary

Version: 2.0

Base score: 2.1

Base severity: LOW

Vector:

AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

Oracle Corporation

>>vm_virtualbox>>Versions before 6.1.34(exclusive)

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://security.gentoo.org/glsa/202208-36	secalert_us@oracle.com	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	secalert_us@oracle.com	Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/202208-36

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2022.html

Source: secalert_us@oracle.com

Resource:

Vendor Advisory

Similar CVEs

155Records found

CVE-2013-2415

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-2.1||LOW

EPSS-0.11% / 29.91%

7 Day CHG~0.00%

Published-17 Apr, 2013 | 15:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows local users to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "processing of MTOM attachments" and the creation of temporary files with weak permissions.

Vendor-n/a Oracle Corporation

Product-jre jdk n/a

CVE-2021-2128

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.14% / 35.31%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:12

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Vendor-Oracle Corporation

Product-vm_virtualbox VM VirtualBox

CVE-2021-20191

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.03% / 5.82%

7 Day CHG~0.00%

Published-26 May, 2021 | 00:00

Updated-03 Aug, 2024 | 17:30

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

Vendor-n/a Oracle Corporation Red Hat, Inc.

Product-cisco_nx-os_collection virtualization google_cloud_platform_ansible_collection community_general_collection ansible docker_community_collection community_network_collection ansible_tower ansible

CWE ID-CWE-532

Insertion of Sensitive Information into Log File

CVE-2020-8908

Matching Score-8

Assigner-Google LLC

View Details

Matching Score-8

Assigner-Google LLC

CVSS Score-3.3||LOW

EPSS-0.07% / 21.00%

7 Day CHG~0.00%

Published-10 Dec, 2020 | 22:10

Updated-04 Aug, 2024 | 10:12

Temp directory permission issue in Guava

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Vendor-quarkus NetApp, Inc.Google LLC Oracle Corporation

Product-guava peoplesoft_enterprise_peopletools communications_cloud_native_core_network_slice_selection_function weblogic_server communications_pricing_design_center quarkus primavera_unifier nosql_database communications_cloud_native_core_network_repository_function active_iq_unified_manager commerce_guided_search retail_customer_management_and_segmentation_foundation data_integrator Guava

CWE ID-CWE-378

Creation of Temporary File With Insecure Permissions

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2016-8967

Matching Score-8

Assigner-IBM Corporation

View Details

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.05% / 16.13%

7 Day CHG~0.00%

Published-01 Feb, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user.

Vendor-Linux Kernel Organization, Inc Oracle Corporation HP Inc.IBM Corporation Microsoft Corporation

Product-bigfix_inventory license_metric_tool aix solaris hp-ux linux_kernel windows BigFix Inventory

CVE-2022-21487

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs