CVE-2017-11791

Published: Nov 15, 2017 Last Modified: Apr 20, 2025

ExploitDB:

Other exploit source:

Google Dorks:

LOW 3,1

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: none

User Interaction: required

Scope: unchanged

Confidentiality: low

Integrity: none

Availability: none

LOW 2,6

Source: [email protected]

Access Vector: network

Access Complexity: high

Authentication: none

Confidentiality: partial

Integrity: none

Availability: none

Description

AI Translation Available

ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine handles objects in memory, aka 'Scripting Engine Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2017-11834.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,1555

Percentile

0,9th

Updated

EPSS Score Trend (Last 90 Days)

200

Exposure of Sensitive Information to an Unauthorized Actor

Draft

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Confidentiality

Potential Impacts:

Read Application Data

Applicable Platforms

Technologies: Mobile, Not Technology-Specific, Web Based

Likelihood of Exploit: High

View CWE Details

Application

Chakracore by Microsoft

Product Information

Vendor Microsoft

Product Chakracore

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Application

Internet Explorer by Microsoft

Product Information

Vendor Microsoft

Product Internet Explorer

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Application

Edge by Microsoft

Product Information

Vendor Microsoft

Product Edge

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

https://portal.msrc.microsoft.com/en-US/security-guidance/a…

Patch Vendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-117…

http://www.securityfocus.com/bid/101715