CVE-2008-4033
medium · 4.3Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."
4.3
CVSS
27.7%
EPSS (exploit prob.)
98th
EPSS percentile
2008-11-12
Published
AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | xml_core_services | 4.0 |
| microsoft | windows_2000 | all versions |
| microsoft | windows_2003_server | all versions |
| microsoft | windows_2003_server | all versions |
| microsoft | windows_7 | all versions |
| microsoft | windows_7 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | r2 |
| microsoft | windows_server_2008 | r2 |
| microsoft | windows_vista | all versions |
| microsoft | windows_vista | all versions |
| microsoft | windows_xp | all versions |
| microsoft | windows_xp | all versions |
| microsoft | xml_core_services | 3.0 |
| microsoft | windows_2000 | all versions |
| microsoft | windows_2003_server | all versions |
| microsoft | windows_2003_server | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_vista | all versions |
| microsoft | windows_xp | all versions |
| microsoft | windows_xp | all versions |
| microsoft | xml_core_services | 6.0 |
| microsoft | windows_2000 | all versions |
| microsoft | windows_2003_server | all versions |
| microsoft | windows_2003_server | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_vista | all versions |
| microsoft | windows_xp | all versions |
| microsoft | windows_xp | all versions |
| microsoft | xml_core_services | 5.0 |
| microsoft | expression_web | all versions |
| microsoft | expression_web | 2 |
| microsoft | groove | 2007 |
| microsoft | office | 2003 |
| microsoft | office | 2007 |
| microsoft | office_compatibility_pack | all versions |
| microsoft | office_compatibility_pack | all versions |
| microsoft | office_word_viewer | 2003 |
| microsoft | sharepoint_server | 2007 |
Check a specific version with /api/v1/cve/match.
References
- http://marc.info/?l=bugtraq&m=122703006921213&w=2
- http://securitytracker.com/id?1021164
- http://www.securityfocus.com/bid/32204
- http://www.us-cert.gov/cas/techalerts/TA08-316A.html
- http://www.vupen.com/english/advisories/2008/3111
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847
- http://marc.info/?l=bugtraq&m=122703006921213&w=2
- http://securitytracker.com/id?1021164
- http://www.securityfocus.com/bid/32204
- http://www.us-cert.gov/cas/techalerts/TA08-316A.html
- http://www.vupen.com/english/advisories/2008/3111
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2008-4033