Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-8145 — Sensitive Information Exposure in Microsoft Chakracore

CWE-200 — Sensitive Information ExposureCWE-787 — Out-of-bounds WriteCWE-843 — Type Confusion10 documents6 sources
Severity
7.5HIGHNVD
EPSS
72.1%
top 1.25%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
5
Microsoft ChakracoreMicrosoft Internet Explorer 10Microsoft Internet Explorer 11+2 more
Timeline
PublishedMay 9
Latest updateMay 13

Description

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8133, CVE-2018-8177.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5microsoft/internet_explorer_10Windows Server 2012
▶CVEListV5microsoft/internet_explorer_1118 versions+17
▶CVEListV5microsoft/chakracoreChakraCore

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

7
GHSA
ChakraCore information disclosure vulnerability↗2022-05-13
▶
OSV
ChakraCore information disclosure vulnerability↗2022-05-13
▶
GHSA
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
ChakraCore RCE Vulnerability↗2022-05-13
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Edge Chakra JIT - Out-of-Bounds Reads/Writes↗2018-07-12
▶

📋Vendor Advisories

1
Microsoft
Scripting Engine Information Disclosure Vulnerability↗2018-05-08
▶
CVE-2018-8145 — Sensitive Information Exposure | cvebase