Actively exploited · Published Jul 11, 2018 · Assigned by microsoft
CVE-2018-8298
High 7.5 Exploited
In plain English
A high-severity type confusion in ChakraCore from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 74.7% (higher than 99.5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 17, 2022.
Official description
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | microsoft.chakracore | 1.10.1 | GHSA-wgw2-wwq8-c7wf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | ChakraCore | ChakraCore |
Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 x_refsource_CONFIRM
- 104639 vdb-entry, x_refsource_BID
- 45217 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298 government-resource