CVE-2008-4033

N/A

Published: November 12, 2008 at 11:00 PM UTC

Updated: June 16, 2026 at 10:57 PM UTC

13 products affected across 1 vendorXML Core ServicesWindows Server 2008Windows 7

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 28%

Description

Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

XML Core Services · Microsoft

95%

3.0 4.0 5.0 6.0

microsoft-expression-web (environment) · microsoft-groove (environment) · microsoft-office (environment) · microsoft-office-compatibility-pack (environment) · microsoft-office-word-viewer (environment) · microsoft-sharepoint-server (environment) · microsoft-windows-2000 (environment) · microsoft-windows-2003-server (environment) · microsoft-windows-7 (environment) · microsoft-windows-server-2008 (environment) · microsoft-windows-vista (environment) · microsoft-windows-xp (environment)

Expression Web · Microsoftdevice

80%

All versions

Groove · Microsoftdevice

80%

All versions

Office · Microsoftdevice

80%

All versions

Office Compatibility Pack · Microsoftdevice

80%

All versions