CVE-2008-1544
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6,...
CVE-2008-1544 is a high vulnerability (CVSS 7.1) in Microsoft Internet Explorer, published March 28, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 26.3%, the 98th percentile. No source names a fixed version.
- Severity
- 7.1 HighCVSS 2.0, NVD
- Exploit chance
- 26.3%EPSS, 98th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
Exploit likelihood
Affected products
What each source reports
NVD Score used
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
- Record
CVE-2008-1544- CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:C/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
- Record
CVE-2008-1544- Updated
- 2026-11-02
EUVDEUVD-2008-1545No score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
- Record
EUVD-2008-1545- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-63q6-hp4x-52r6No score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6,...
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
- Record
GHSA-63q6-hp4x-52r6- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-031
mindedsecurity.com/MSA02240108.html
secunia.com/advisories/29453
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5291
vupen.com/english/advisories/2008/1778
securitytracker.com/id?1020226
Show 8 moreShow less
us-cert.gov/cas/techalerts/TA08-162B.html
marc.info?l=bugtraq&m=121380194923597&w=2
securityfocus.com/bid/28379
securityreason.com/securityalert/3785
nvd.nist.gov/vuln/detail/CVE-2008-1544
github.com/advisories/GHSA-63q6-hp4x-52r6