{"containers": {"cna": {"affected": [{"product": "Oracle VM VirtualBox", "vendor": "Oracle Corporation", "versions": [{"lessThan": "5.0.34", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "5.1.16", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2017-04-18T00:00:00", "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Supported versions that are affected are Prior to 5.0.34 and Prior to 5.1.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)."}], "problemTypes": [{"descriptions": [{"description": "Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T09:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"}, {"name": "1038288", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038288"}, {"name": "97698", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/97698"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2017-3538", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Oracle VM VirtualBox", "version": {"version_data": [{"version_affected": "<", "version_value": "5.0.34"}, {"version_affected": "<", "version_value": "5.1.16"}]}}]}, "vendor_name": "Oracle Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Supported versions that are affected are Prior to 5.0.34 and Prior to 5.1.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data."}]}]}, "references": {"reference_data": [{"name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"}, {"name": "1038288", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038288"}, {"name": "97698", "refsource": "BID", "url": "http://www.securityfocus.com/bid/97698"}]}}}}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2017-3538", "datePublished": "2017-04-24T19:00:00", "dateReserved": "2016-12-06T00:00:00", "dateUpdated": "2017-07-10T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*", "matchCriteriaId": "D1104DF4-94D3-4246-9C14-CB9E73D518B5", "versionEndIncluding": "5.0.32", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "556DF6FA-321E-40FE-BC74-44B192012B2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "5F9302DA-3BFB-44DF-81E6-6AD796C96A8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "297D4203-CE68-40FF-AF64-ABD1E7C16861", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "0896B11F-DC77-4FD0-A9FE-E9D041A30C9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "519F2276-5E13-4948-BCFC-BA90E30462A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.10:*:*:*:*:*:*:*", "matchCriteriaId": "F2D191EF-84DC-47ED-9C44-A400C33928CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.12:*:*:*:*:*:*:*", "matchCriteriaId": "8899F709-B14F-4889-958D-F9782EE3B9C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.1.14:*:*:*:*:*:*:*", "matchCriteriaId": "7DB38DB8-E7A6-4DE6-BCCF-FEC0E510FE02", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Supported versions that are affected are Prior to 5.0.34 and Prior to 5.1.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el componente Oracle VM VirtualBox de Oracle Virtualization (subcomponente: Shared Folder). Versiones compatibles que son afectadas son anteriores a 5.0.34 y anteriores a 5.1.16. Vulnerabilidad difici de explotar permite que el atacante de bajo privilegio con el inicio de sesi\u00f3n a la infraestructura donde Oracle VirtualBox VM ejecuta comprometer Oracle VirtualBox VM. Aunque la vulnerabilidad est\u00e1 en Oracle VirtualBox, los ataques pueden afectar significativamente a otros productos. Los ataques exitosos de esta vulnerabilidad pueden provocar la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n no autorizadas de acceso a datos cr\u00edticos o todos los datos accesibles de Oracle VirtualBox, as\u00ed como el acceso no autorizado a datos cr\u00edticos o el acceso completo a todos los datos accesibles de Oracle VirtualBox. CVSS 3.0 Base Score 7.5 (Impactos de confidencialidad e integridad). Vector CVSS:"}], "id": "CVE-2017-3538", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 9.2, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 1.1, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-24T19:59:04.083", "references": [{"source": "secalert_us@oracle.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"}, {"source": "secalert_us@oracle.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/97698"}, {"source": "secalert_us@oracle.com", "url": "http://www.securitytracker.com/id/1038288"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}