CVE-2008-1545
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does...
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
Exploit likelihood
What each source reports
NVD Score used
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
CVE-2008-1545- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
CVE-2008-1545- Updated
- 2026-11-02
EUVDEUVD-2008-1546 No score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
EUVD-2008-1546- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqxg-27cj-85m3 No score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does...
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
GHSA-mqxg-27cj-85m3- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1545 is a medium vulnerability (CVSS 4.3) in Microsoft Internet Explorer, published March 28, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.8%, the 96th percentile. No source names a fixed version.
References
secunia.com/advisories/29453
securityreason.com/securityalert/3786
mindedsecurity.com/MSA01240108.html
vupen.com/english/advisories/2008/0980
securityfocus.com/archive/1/489960/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/42804
nvd.nist.gov/vuln/detail/CVE-2008-1545
github.com/advisories/GHSA-mqxg-27cj-85m3