VULNERABILITY INTELLIGENCE

CVE-2008-4033

CVSS score4.3 MEDIUM
EPSS probability27.75%
CISA KEVNot currently listed
Published2008-11-12
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N

Description

Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references