7.1

CVE-2008-1544

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Internet Explorer Version5.01 Updatesp4
   Microsoft ≫ Windows 2000 Updatesp4
Microsoft ≫ Internet Explorer Version6 Updatesp1
   Microsoft ≫ Windows 2000 Updatesp4
Microsoft ≫ Internet Explorer Version6
   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Updatesp1
   Microsoft ≫ Windows Server 2003 Updatesp1 Editionitanium
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Editionx64
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp2 Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp3
Microsoft ≫ Internet Explorer Version7
   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Updatesp1
   Microsoft ≫ Windows Server 2003 Updatesp1 Editionitanium
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Vista
   Microsoft ≫ Windows Vista Editionx64
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Xp Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp2 Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 51.21% 0.978
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.1 8.6 6.9
AV:N/AC:M/Au:N/C:C/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.