CVE-2020-17054: 
C# vulnerability analysis and mitigation

The Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2020-17054) was disclosed in November 2020. This vulnerability affects Microsoft Edge (EdgeHTML-based) and Internet Explorer browsers. The vulnerability is unique from CVE-2020-17048 and impacts various versions of Microsoft Windows and Microsoft Edge (NVD).

The vulnerability has received varying CVSS severity ratings, with the NVD assigning a CVSS 3.1 Base Score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, while Microsoft assigned a more moderate score of 4.2 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The vulnerability is classified as an Out-of-bounds Write (CWE-787) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute remote code on the affected system, potentially gaining the same user rights as the current user. The vulnerability requires user interaction and has high attack complexity (NVD).

The vulnerability requires user interaction to exploit and has high attack complexity. At the time of disclosure, there were no known exploits of this vulnerability in the wild (Rapid7).

Microsoft has released security updates to address this vulnerability. Organizations should apply the appropriate patches through Windows Update. For systems using Security-Only patches, it's important to note that separate Cumulative Security Updates for Internet Explorer are required, as browser remediations are not included in Security-Only patches (Rapid7).