CVE-2021-25319CWE-276

virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group

High · published May 5, 2021

CVSS v3.1
7.8
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2021-05-05T08:25Z
EPSS history
Timeline
  • 05 MAY 08:25Z
    virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group
    cvelistv5