CVE-2020-2894
Estado: ModificadaMedia (6)—
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- Puntuación base: 6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.57%
- Percentil entre todas las CVEs puntuadas: 46
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-noinfo
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00001.html
- https://security.gentoo.org/glsa/202101-09
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-581/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00001.html
- https://security.gentoo.org/glsa/202101-09
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-581/
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-2894",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2020-2894",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-09-27T18:01:34.446592Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 2.1,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "secalert_us@oracle.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 6,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 4,
"exploitabilityScore": 1.5
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 4,
"exploitabilityScore": 1.5
}
]
},
"affected": [
{
"source": "secalert_us@oracle.com",
"affectedData": [
{
"vendor": "Oracle Corporation",
"product": "VM VirtualBox",
"versions": [
{
"status": "affected",
"version": "prior to 5.2.40"
},
{
"status": "affected",
"version": "prior to 6.0.20"
},
{
"status": "affected",
"version": "prior to 6.1.6"
}
]
}
]
}
],
"published": "2020-04-15T14:15:34.233",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00001.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://security.gentoo.org/glsa/202101-09",
"tags": [
"Third Party Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-581/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert_us@oracle.com"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00001.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/202101-09",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-581/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)."
},
{
"lang": "es",
"value": "Vulnerabilidad en el producto Oracle VM VirtualBox de Oracle Virtualization (componente: Core). Las versiones compatibles afectadas son anteriores a la versión 5.2.40, anteriores a la versión 6.0.20 y anteriores a la versión 6.1.6. La vulnerabilidad fácilmente explotable permite a los atacantes con privilegios elevados iniciar sesión en la infraestructura donde se ejecuta Oracle VM VirtualBox para comprometer Oracle VM VirtualBox. Si bien la vulnerabilidad se encuentra en Oracle VM VirtualBox, los ataques pueden afectar significativamente a productos adicionales. Los ataques con éxito de esta vulnerabilidad pueden resultar en la adquisición de Oracle VM VirtualBox. CVSS 3.0 Base Score 6.0 (Impactos de confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS: 3.0 / AV: L / AC: L / PR: H / UI: N / S: C / C: H / I: N / A: N)."
}
],
"lastModified": "2026-06-17T03:13:11.920",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "129CB958-DAE6-436B-94A7-C2EB377A4BAD",
"versionEndExcluding": "5.2.40"
},
{
"criteria": "cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E50538C-FD1A-44E5-B24D-A0C2E72E43C9",
"versionEndExcluding": "6.0.20",
"versionStartIncluding": "6.0.0"
},
{
"criteria": "cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81D2771A-60CB-403C-A62F-3DBC8E29A94E",
"versionEndExcluding": "6.1.6",
"versionStartIncluding": "6.1.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert_us@oracle.com"
}