CVE-2008-1545
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does...
CVE-2008-1545 is a medium vulnerability (CVSS 4.3) in Microsoft Internet Explorer, published March 28, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.8%, the 96th percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 11.8%EPSS, 96th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
Exploit likelihood
Affected products
What each source reports
NVD Score used
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
CVE-2008-1545- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
CVE-2008-1545- Updated
- 2026-11-02
EUVDEUVD-2008-1546No score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
EUVD-2008-1546- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqxg-27cj-85m3No score
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does...
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
- Record
GHSA-mqxg-27cj-85m3- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/29453
securityreason.com/securityalert/3786
mindedsecurity.com/MSA01240108.html
vupen.com/english/advisories/2008/0980
securityfocus.com/archive/1/489960/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/42804
nvd.nist.gov/vuln/detail/CVE-2008-1545
github.com/advisories/GHSA-mqxg-27cj-85m3