CVE-2008-4033 Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensiti...
MediumCVSS 4.3
EPSS 27.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft xml core services | = 4.0 | No fix listed |
| Microsoft xml core services | = 3.0 | No fix listed |
| Microsoft xml core services | = 6.0 | No fix listed |
| Microsoft xml core services | = 5.0 | No fix listed |
References
- SSRT080164 vendor-advisory
- 1021164 vdb-entry
- 32204 patch vdb-entry
- TA08-316A third-party-advisory us-government-resource
- ADV-2008-3111 vdb-entry
- MS08-069 vendor-advisory
- oval:org.mitre.oval:def:5847 signature vdb-entry