NVD

Id
1488  
Name
CVE-2008-1544  
Description
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.  
Reject
 
CVSS Version
2  
CVSS Score
7.1  
Severity
High  
CVSS Base Score
7.1  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-03-28  
Modified Date
2011-06-14  
Seq
2008-1544  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
9615 1488 CVE-2008-1544 SSRT080087  View
9616 1488 CVE-2008-1544 oval:org.mitre.oval:def:5291  View
9617 1488 CVE-2008-1544 3785  View
9618 1488 CVE-2008-1544 MS08-031  View
9619 1488 CVE-2008-1544 http://www.mindedsecurity.com/MSA02240108.html  View
9620 1488 CVE-2008-1544 20080321 [MSA02240108] IE7 allows overwriting of several headers leading to Http request Splitting and smuggling.  View
9621 1488 CVE-2008-1544 28379  View
9622 1488 CVE-2008-1544 1020226  View
9623 1488 CVE-2008-1544 TA08-162B  View
9624 1488 CVE-2008-1544 ADV-2008-0980  View
9625 1488 CVE-2008-1544 ADV-2008-1778  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46124 JVNDB-2008-001434 Microsoft Internet Explorer の setRequestHeader メソッドにおける危険な HTTP リクエストヘッダをブロックしない脆弱性 Microsoft Internet Explorer の XMLHttpRequest オブジェクトにおける setRequestHeader メソッドには、特定の 8 ビット文字列をヘッダ名に追加する際、危険な HTTP リクエストヘッダをブロックしない脆弱性が存在します。 CVE-2008-1544 31657 CVE-2008-1544 1488 5.8 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001434.html 2008-06-11 2008-07-03 View