GitHub Advisoryadvisory · NuGet
GHSA-hrf4-ww4w-6rv6 ChakraCore RCE Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2017-11797
- Ecosystem
- NuGet
- Packages
- Microsoft.ChakraCore
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-200
- Reviewed
- 2023-07-27
Affected packages
• NuGet Microsoft.ChakraCore: < 1.7.3 → fixed in 1.7.3
Description
ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Related
Alias · CVE (1)
- CVE-2017-11797 ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-11797 advisory
- https://github.com/chakra-core/ChakraCore/pull/3917 web
- https://github.com/chakra-core/ChakraCore/commit/9a3ad7ccba1fae1549e21369982d59d45a2ab6cf web
- https://github.com/chakra-core/ChakraCore package
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11797 web
- https://web.archive.org/web/20210124110143/http://www.securityfocus.com/bid/101145 web