CVE-2008-4033: microsoft xml_core_services
Vulnerability summary
CVE-2008-4033 is a medium (CVSS 4.3) vulnerability in microsoft xml_core_services. EPSS estimates a 27.75% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 12-11-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
27.75%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 27.75% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Microsoft1 product
- xml_core_services4.0 | 3.0 | 6.0 | 5.0
1 vendor · 1 product
References
7 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847VDB EntrySignatureX Refsource OVAL
- www.us-cert.gov/cas/techalerts/TA08-316A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069Vendor AdvisoryX Refsource MS