Advisory Details

February 9th, 2023

Oracle VirtualBox Teleporter Improper Error Handling Authentication Bypass Vulnerability

CVE ID	CVE-2023-21886
CVSS SCORE	8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	Oracle
AFFECTED PRODUCTS	VirtualBox
VULNERABILITY DETAILS	This vulnerability allows remote attackers to bypass authentication on affected installations of Oracle VirtualBox. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Teleporter service. The issue results from the lack of proper error handling when validating teleporter credentials. An attacker can leverage this vulnerability to bypass authentication on the system.
ADDITIONAL DETAILS	Oracle has issued an update to correct this vulnerability. More details can be found at: https://www.oracle.com/security-alerts/cpujan2023.html
DISCLOSURE TIMELINE	2022-11-01 - Vulnerability reported to vendor 2023-02-09 - Coordinated public release of advisory
CREDIT	Exist(@exist91240480)

BACK TO ADVISORIES