CVE-2020-17054 - Vulnerability Details - OpenCVE

Chakra Scripting Engine Memory Corruption Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.0183.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Microsoft	Chakracore Edge Windows 10 Windows Server 2016 Windows Server 2019

Configuration 1 [-]

AND

cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_10:-:::::::*
	cpe:2.3:o:microsoft:windows_10:20h2:::::::*
	cpe:2.3:o:microsoft:windows_10:1607:::::::*
	cpe:2.3:o:microsoft:windows_10:1803:::::::*
	cpe:2.3:o:microsoft:windows_10:1809:::::::*
	cpe:2.3:o:microsoft:windows_10:1903:::::::*
	cpe:2.3:o:microsoft:windows_10:1909:::::::*
	cpe:2.3:o:microsoft:windows_10:2004:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

Configuration 2 [-]

cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-1633	Chakra Scripting Engine Memory Corruption Vulnerability
Github GHSA	GHSA-88cw-3m6x-49f7	Out-of-bounds Write in ChakraCore

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17054

History

Tue, 01 Oct 2024 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2020-11-11T06:48:19

Updated: 2024-10-01T15:56:26.294Z

Reserved: 2020-08-04T00:00:00

Link: CVE-2020-17054

Vulnrichment

Updated: 2024-08-04T13:53:16.243Z

NVD

Status : Modified

Published: 2020-11-11T07:15:16.840

Modified: 2024-11-21T05:07:43.260

Link: CVE-2020-17054

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"title": "Chakra Scripting Engine Memory Corruption Vulnerability", "datePublic": "2020-11-10T08:00:00+00:00", "affected": [{"vendor": "Microsoft", "product": "ChakraCore", "cpes": ["cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "0", "lessThan": "publication", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Edge (EdgeHTML-based)", "cpes": ["cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*"], "platforms": ["Windows 10 Version 1803 for 32-bit Systems", "Windows 10 Version 1803 for x64-based Systems", "Windows 10 Version 1803 for ARM64-based Systems", "Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows Server 2019", "Windows 10 Version 1909 for 32-bit Systems", "Windows 10 Version 1909 for x64-based Systems", "Windows 10 Version 1909 for ARM64-based Systems", "Windows 10 Version 1903 for 32-bit Systems", "Windows 10 Version 1903 for x64-based Systems", "Windows 10 Version 1903 for ARM64-based Systems", "Windows 10 Version 2004 for 32-bit Systems", "Windows 10 Version 2004 for ARM64-based Systems", "Windows 10 Version 2004 for x64-based Systems", "Windows 10 for 32-bit Systems", "Windows 10 for x64-based Systems", "Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows 10 Version 20H2 for 32-bit Systems", "Windows 10 Version 20H2 for ARM64-based Systems"], "versions": [{"version": "1.0..0", "lessThan": "publication", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Chakra Scripting Engine Memory Corruption Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-09-10T15:51:58.998Z"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17054"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 4.2, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:53:16.243Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17054"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-02-27T17:05:49.568986Z", "id": "CVE-2020-17054", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T15:56:26.294Z"}}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2020-17054", "datePublished": "2020-11-11T06:48:19", "dateReserved": "2020-08-04T00:00:00", "dateUpdated": "2024-10-01T15:56:26.294Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17054", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:53:16.243Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-17054", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-27T17:05:49.568986Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T15:46:00.390Z"}}], "cna": {"title": "Chakra Scripting Engine Memory Corruption Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "ChakraCore", "versions": [{"status": "affected", "version": "0", "lessThan": "publication", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Edge (EdgeHTML-based)", "versions": [{"status": "affected", "version": "1.0..0", "lessThan": "publication", "versionType": "custom"}], "platforms": ["Windows 10 Version 1803 for 32-bit Systems", "Windows 10 Version 1803 for x64-based Systems", "Windows 10 Version 1803 for ARM64-based Systems", "Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows Server 2019", "Windows 10 Version 1909 for 32-bit Systems", "Windows 10 Version 1909 for x64-based Systems", "Windows 10 Version 1909 for ARM64-based Systems", "Windows 10 Version 1903 for 32-bit Systems", "Windows 10 Version 1903 for x64-based Systems", "Windows 10 Version 1903 for ARM64-based Systems", "Windows 10 Version 2004 for 32-bit Systems", "Windows 10 Version 2004 for ARM64-based Systems", "Windows 10 Version 2004 for x64-based Systems", "Windows 10 for 32-bit Systems", "Windows 10 for x64-based Systems", "Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows 10 Version 20H2 for 32-bit Systems", "Windows 10 Version 20H2 for ARM64-based Systems"]}], "datePublic": "2020-11-10T08:00:00+00:00", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17054", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en-US", "value": "Chakra Scripting Engine Memory Corruption Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "Impact", "description": "Remote Code Execution"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-09-10T15:51:58.998Z"}}}, "cveMetadata": {"cveId": "CVE-2020-17054", "state": "PUBLISHED", "dateUpdated": "2024-10-01T15:56:26.294Z", "dateReserved": "2020-08-04T00:00:00", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2020-11-11T06:48:19", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*", "matchCriteriaId": "77D197D7-57FB-4898-8C70-B19D5F0D5BE0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*", "matchCriteriaId": "21540673-614A-4D40-8BD7-3F07723803B0", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*", "matchCriteriaId": "9E2C378B-1507-4C81-82F6-9F599616845A", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "matchCriteriaId": "E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*", "matchCriteriaId": "7CB85C75-4D35-480E-843D-60579EC75FCB", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*", "matchCriteriaId": "6B8F3DD2-A145-4AF1-8545-CC42892DA3D1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*", "matchCriteriaId": "3FB5CDAE-C713-4D9D-9D6A-2C2E8924A4BB", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*", "matchCriteriaId": "E9273B95-20ED-4547-B0A8-95AD15B30372", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*", "matchCriteriaId": "AAE74AF3-C559-4645-A6C0-25C3D647AAC8", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA0497E6-1720-47DF-85F7-437857F55663", "versionEndExcluding": "1.11.23", "versionStartIncluding": "1.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Chakra Scripting Engine Memory Corruption Vulnerability"}, {"lang": "es", "value": "Vulnerabilidad de Corrupci\u00f3n de Memoria del Motor de Scripting de Chakra Este ID de CVE es diferente deCVE-2020-17048."}], "id": "CVE-2020-17054", "lastModified": "2024-11-21T05:07:43.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "secure@microsoft.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2020-11-11T07:15:16.840", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17054"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17054"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}