7.6

CVE-2018-8298

Warnung
Exploit

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Chakracore Version < 1.10.1

03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

ChakraCore Scripting Engine Type Confusion Vulnerability

Schwachstelle

The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 89.01% 0.995
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 7.6 4.9 10
AV:N/AC:H/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

http://www.securityfocus.com/bid/104639
Third Party Advisory
Broken Link
VDB Entry
https://www.exploit-db.com/exploits/45217/
Third Party Advisory
Exploit
VDB Entry