CVEvulnerability
CVE-2008-4033
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-11-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."
Affected configurations
• microsoft xml core services 4.0
• microsoft xml core services 3.0
• microsoft xml core services 6.0
• microsoft xml core services 5.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://marc.info/?l=bugtraq&m=122703006921213&w=2 marc.info
- http://securitytracker.com/id?1021164 securitytracker.com
- http://www.securityfocus.com/bid/32204 Patch
- http://www.us-cert.gov/cas/techalerts/TA08-316A.html Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2008/3111 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847 oval.cisecurity.org
- http://marc.info/?l=bugtraq&m=122703006921213&w=2 marc.info
- http://securitytracker.com/id?1021164 securitytracker.com
- http://www.securityfocus.com/bid/32204 Patch
- http://www.us-cert.gov/cas/techalerts/TA08-316A.html Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2008/3111 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847 oval.cisecurity.org