Advisory details:
vulnrichment / CVE-2018-8298
| Advisory ID | vulnrichment/CVE-2018-8298 |
| Aliases | |
| Summary | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.5 | |
| ssvc | Attend |
| Reference id | Reference type | URL |
|---|---|---|
| 104639 | Advisory | http://www.securityfocus.com/bid/104639 |
| 45217 | Exploit | https://www.exploit-db.com/exploits/45217/ |
| CVE-2018-8298 | Other | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 |
| Data source | Exploit-DB |
|---|---|
| Date added | Aug. 17, 2018 |
| Description | Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type Confusion |
| Ransomware campaign use | Known |
| Source publication date | Aug. 17, 2018 |
| Exploit type | dos |
| Platform | windows |
| Source update date | Aug. 17, 2018 |
| Source URL | https://bugs.chromium.org/p/project-zero/issues/detail?id=1582 |
| Data source | KEV |
|---|---|
| Date added | March 3, 2022 |
| Description | The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution. |
| Required action | Apply updates per vendor instructions. |
| Due date | March 17, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2018-8298 |
| Ransomware campaign use | Unknown |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T16:26:02Z/
Decision: Attend
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2018/8xxx/CVE-2018-8298.json
Source Advisory: vulnrichment/CVE-2018-8298
[{'Exploitation': 'active'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]