CVE-2008-4033 : Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office,

Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."

Published 2008-11-12 23:30:03

Updated 2018-10-12 21:48:32

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2008-4033

EPSS FAQ

94.46%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-4033

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2008-4033

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-4033

http://www.securityfocus.com/bid/32204

Patch
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069

Microsoft Security Bulletin MS08-069 - Critical | Microsoft Learn

CVEs referencing this url
http://marc.info/?l=bugtraq&m=122703006921213&w=2

'[security bulletin] HPSBST02386 SSRT080164 rev.1 - Storage Management Appliance (SMA), Microsoft Pat' - MARC

CVEs referencing this url
http://www.us-cert.gov/cas/techalerts/TA08-316A.html

Page Not Found | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847
http://www.vupen.com/english/advisories/2008/3111

Webmail: access your OVH emails on ovhcloud.com | OVHcloud

CVEs referencing this url
http://securitytracker.com/id?1021164

GoDaddy Domain Name Search

CVEs referencing this url

Products affected by CVE-2008-4033

Microsoft » Xml Core Services » Version: 3.0
cpe:2.3:a:microsoft:xml_core_services:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2000 » Update SP4
When used together with: Microsoft » Windows 2003 Server » Update SP1
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows Server 2008 » Version: N/A
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Xp » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
Microsoft » Xml Core Services » Version: 4.0
cpe:2.3:a:microsoft:xml_core_services:4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2000 » Update SP4
When used together with: Microsoft » Windows 2003 Server » Update SP1
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows 7
When used together with: Microsoft » Windows 7 » Update SP1
When used together with: Microsoft » Windows Server 2008 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Version: N/A
When used together with: Microsoft » Windows Server 2008 » Version: R2
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
Microsoft » Xml Core Services » Version: 6.0
cpe:2.3:a:microsoft:xml_core_services:6.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2000 » Update SP4
When used together with: Microsoft » Windows 2003 Server » Update SP1
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows Server 2008 » Version: N/A
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Xp » Update SP2 For X64
When used together with: Microsoft » Windows Xp » Update SP3
Microsoft » Xml Core Services » Version: 5.0
cpe:2.3:a:microsoft:xml_core_services:5.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Expression Web
When used together with: Microsoft » Expression Web » Version: 2
When used together with: Microsoft » Groove » Version: 2007
When used together with: Microsoft » Office » Version: 2003 Update SP3
When used together with: Microsoft » Office » Version: 2007 Update SP1
When used together with: Microsoft » Office Compatibility Pack
When used together with: Microsoft » Office Compatibility Pack » Update SP1
When used together with: Microsoft » Office Word Viewer » Version: 2003 Update SP3
When used together with: Microsoft » Sharepoint Server » Version: 2007
When used together with: Microsoft » Sharepoint Server » Version: 2007 Update SP1

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!

Accept Close

Vulnerability Details : CVE-2008-4033

Exploit prediction scoring system (EPSS) score for CVE-2008-4033

CVSS scores for CVE-2008-4033

CWE ids for CVE-2008-4033

References for CVE-2008-4033

Products affected by CVE-2008-4033