{"api_version":"1","generated_at":"2026-07-23T23:41:42+00:00","cve":"CVE-2022-21627","urls":{"html":"https://cve.report/CVE-2022-21627","api":"https://cve.report/api/cve/CVE-2022-21627.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-21627","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-21627"},"summary":{"title":"CVE-2022-21627","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","state":"PUBLIC","assigner":"secalert_us@oracle.com","published_at":"2022-10-18 21:15:00","updated_at":"2023-01-12 21:17:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://security.gentoo.org/glsa/202212-03","name":"GLSA-202212-03","refsource":"GENTOO","tags":[],"title":"Oracle VirtualBox: Multiple Vulnerabilities (GLSA 202212-03) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.oracle.com/security-alerts/cpuoct2022.html","name":"https://www.oracle.com/security-alerts/cpuoct2022.html","refsource":"MISC","tags":[],"title":"Oracle Critical Patch Update Advisory - October 2022","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21627","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21627","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"21627","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"vm_virtualbox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-21627","qid":"377646","title":"Oracle Managed Virtualization (VM) VirtualBox for Windows Multiple Vulnerabilities (CPUOCT2022)"},{"cve":"CVE-2022-21627","qid":"377647","title":"Oracle Managed Virtualization (VM) VirtualBox for Linux Multiple Vulnerabilities (CPUOCT2022)"},{"cve":"CVE-2022-21627","qid":"710694","title":"Gentoo Linux Oracle VirtualBox Multiple Vulnerabilities (GLSA 202212-03)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2022-21627","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"VM VirtualBox","version":{"version_data":[{"version_value":"6.1.40","version_affected":"<"}]}}]},"vendor_name":"Oracle Corporation"}]}},"description":{"description_data":[{"lang":"eng","value":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},"impact":{"cvss":{"baseScore":"4.4","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox."}]}]},"references":{"reference_data":[{"url":"https://www.oracle.com/security-alerts/cpuoct2022.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpuoct2022.html"},{"refsource":"GENTOO","name":"GLSA-202212-03","url":"https://security.gentoo.org/glsa/202212-03"}]}},"nvd":{"publishedDate":"2022-10-18 21:15:00","lastModifiedDate":"2023-01-12 21:17:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":0.8,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.40","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"21627","Ordinal":"221108","Title":"CVE-2022-21627","CVE":"CVE-2022-21627","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"21627","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}