TI-2017-08745 Aliases CVE-2017-11797 GHSA-hrf4-ww4w-6rv6

Information disclosure in Microsoft ChakraCore

MEDIUM 42CWE-200Published 2017-10-13 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Why it matters now

EPSS 0.05799 93rd percentileScored 2026-11-07

Fix Fixed Microsoft.ChakraCore (NuGet): 1.7.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	ChakraCore	ChakraCore	—	No fix listed	CNA
—	Microsoft.ChakraCore (NuGet)	before 1.7.3	1.7.3	Patch available	GHSA-hrf4-ww4w-6rv6

ChakraCore VendorMicrosoft Affected ChakraCore Fixed in — No fix listed CNA
Microsoft.ChakraCore (NuGet) Vendor— Affected before 1.7.3 Fixed in 1.7.3 Patch available GHSA-hrf4-ww4w-6rv6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:chakracore::::::::	up to 1.7.2	Vulnerable	Microsoft

cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:* Versions up to 1.7.2 Vulnerable ·Microsoft

Remediation

Fix · GHSA-hrf4-ww4w-6rv6 Microsoft.ChakraCore (NuGet) Fixed in 1.7.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2017-11797
2026-10-03 Alias added: GHSA-hrf4-ww4w-6rv6

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11797

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2017-11797

Other 4

TI-2020-00848 Microsoft Browser Memory Corruption Vulnerability KEVCVSS 3.1HIGH 7.5
TI-2018-06000 Type confusion in Microsoft ChakraCore KEVCVSS 3.1HIGH 7.5
TI-2019-00333 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
TI-2019-00359 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
TI-2018-00721 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
TI-2018-00720 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5

See all 254 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences