$ cve CVE-2008-4033 JSON

CVE-2008-4033 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 27.7% (pctl 98)

Patch early

A public exploit exists.

Description

Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS	27.75% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2008-11-12
Last modified	2026-06-16

Affected (13)

Vendor	Product
microsoft	expression web
microsoft	groove
microsoft	office
microsoft	office compatibility pack
microsoft	office word viewer
microsoft	sharepoint server
microsoft	windows 2000
microsoft	windows 2003 server
microsoft	windows 7
microsoft	windows server 2008
microsoft	windows vista
microsoft	windows xp
microsoft	xml core services

Public exploits

Source	Title	Date
exploit-db	Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)	2008-11-23

References

→ the Explorer · watch your stack · NVD