GitHub Advisoryadvisory · NuGet
GHSA-pjpr-2qqp-gprf ChakraCore information disclosure vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2017-0208
- Ecosystem
- NuGet
- Packages
- Microsoft.ChakraCore
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2023-07-27
Affected packages
• NuGet Microsoft.ChakraCore: < 1.4.3 → fixed in 1.4.3
Description
An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, a.k.a. "Scripting Engine Information Disclosure Vulnerability."
Related
Alias · CVE (1)
- CVE-2017-0208 An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-0208 advisory
- https://github.com/chakra-core/ChakraCore/pull/2834 web
- https://github.com/chakra-core/ChakraCore/commit/54d6d085987e2c399863940179db67b594d7f0a3 web
- https://github.com/chakra-core/ChakraCore package
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0208 web
- https://web.archive.org/web/20210124023848/http://www.securityfocus.com/bid/97460 web
- https://web.archive.org/web/20211201121401/http://www.securitytracker.com/id/1038234 web