CVE-2020-2691: Medium severity Oracle VM VirtualBox vulnerability

Q: What is the severity of CVE-2020-2691?

CVE-2020-2691 is considered easily exploitable and poses a significant risk to users of affected Oracle VM VirtualBox versions.

Q: How do I fix CVE-2020-2691?

To address CVE-2020-2691, upgrade Oracle VM VirtualBox to versions 5.2.36, 6.0.16, or 6.1.2 or later.

Q: Who is affected by CVE-2020-2691?

Users running Oracle VM VirtualBox prior to versions 5.2.36, 6.0.16, or 6.1.2 are vulnerable to CVE-2020-2691.

Q: What type of vulnerability is CVE-2020-2691?

CVE-2020-2691 is a core vulnerability in the Oracle VM VirtualBox product that allows a low-privileged attacker to exploit the system.

Q: Can CVE-2020-2691 be exploited remotely?

CVE-2020-2691 requires an attacker to have logon access to the same infrastructure where Oracle VM VirtualBox is running for exploitation.

Published Jan 15, 2020

Updated

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Affected Software

3 affected components

Oracle VM VirtualBox>=5.2.0<5.2.36

Oracle VM VirtualBox>=6.0.0<6.0.16

Oracle VM VirtualBox>=6.1.0<6.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle VM VirtualBox (Core) to a version that resolves this vulnerability.
Fixed in 5.2.36
Upgrade
Upgrade Oracle VM VirtualBox (Core) to a version that resolves this vulnerability.
Fixed in 6.0.16
Upgrade
Upgrade Oracle VM VirtualBox (Core) to a version that resolves this vulnerability.
Fixed in 6.1.2

Event History

Jan 15, 2020

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-2691?

CVE-2020-2691 is considered easily exploitable and poses a significant risk to users of affected Oracle VM VirtualBox versions.

How do I fix CVE-2020-2691?