Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-4033 | First vendor Publication | 2008-11-12 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4033 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-200 | Information Exposure |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:5847 | |||
| Oval ID: | oval:org.mitre.oval:def:5847 | ||
| Title: | MSXML Header Request Vulnerability | ||
| Description: | Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2008-4033 | Version: | 1 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | Microsoft Office 2003 Microsoft Office 2008 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 4 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-11-12 | Name : Microsoft XML Core Services Remote Code Execution Vulnerability (955218) File : nvt/secpod_ms08-069_900058.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 50279 | Microsoft XML Core Services HTTP Request Header Field Cross-domain Session St... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2008-11-13 | IAVM : 2008-A-0084 - Multiple Vulnerabilities in Microsoft XML Core Services Severity : Category II - VMSKEY : V0017877 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2019-09-17 | Microsoft XML core services cross-domain information disclosure attempt RuleID : 51038 - Revision : 1 - Type : BROWSER-IE |
| 2015-04-14 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 33829 - Revision : 2 - Type : OS-WINDOWS |
| 2015-04-14 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 33828 - Revision : 2 - Type : OS-WINDOWS |
| 2015-04-14 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 33827 - Revision : 2 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft XML core services cross-domain information disclosure attempt RuleID : 19818 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 17730 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft XML Core Services cross-site information disclosure attempt RuleID : 17572 - Revision : 11 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Internet Explorer MSXML DLL memory corruption attempt RuleID : 15012 - Revision : 9 - Type : BROWSER-IE |
| 2015-05-28 | Microsoft XML core services cross-domain information disclosure attempt RuleID : 15011 - Revision : 7 - Type : WEB-CLIENT |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-10-30 | Name : The remote Windows host contains unsupported XML parsers. File : ms_msxml_unsupported.nasl - Type : ACT_GATHER_INFO |
| 2008-11-12 | Name : Arbitrary code can be executed on the remote host through the web or email cl... File : smb_nt_ms08-069.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:13:01 |
|
| 2024-11-28 12:16:27 |
|
| 2020-05-23 00:22:14 |
|
| 2019-03-18 12:01:49 |
|
| 2018-10-13 00:22:43 |
|
| 2017-09-29 09:23:42 |
|
| 2016-06-28 17:17:47 |
|
| 2016-04-26 17:48:56 |
|
| 2015-08-19 00:22:57 |
|
| 2015-08-13 17:28:32 |
|
| 2015-08-10 21:26:44 |
|
| 2015-05-28 21:26:27 |
|
| 2014-02-17 10:46:32 |
|
| 2014-01-19 21:25:14 |
|
| 2013-11-11 12:38:03 |
|
| 2013-05-11 00:25:36 |
|
| 2012-11-07 00:17:55 |
|
