VULNERABILITY INTELLIGENCE

CVE-2008-1545

CVSS score4.3 MEDIUM
EPSS probability11.84%
CISA KEVNot currently listed
Published2008-03-28
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N

Description

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references