Lucene search

[email protected]CVE-2018-0818

HistoryJan 10, 2018 - 1:29 a.m.

CVE-2018-0818

2018-01-1001:29:01

[email protected]

web.nvd.nist.gov

microsoft

chakracore

cve-2018-0818

security

vulnerability

control flow guard

scripting engine

bypass

arbitrary code execution

8.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.1%

JSON

Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka “Scripting Engine Security Feature Bypass”.

Affected configurations

Vulners

NVD

Node

microsoft_corporationchakracore

CPENameOperatorVersion
microsoft:chakracoremicrosoft chakracoreeq-

CPE	Name	Operator	Version
microsoft:chakracore	microsoft chakracore	eq	-

CNA Affected

[
  {
    "product": "ChakraCore",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "ChakraCore"
      }
    ]
  }
]