CVE-2008-1545

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request…

published March 28, 2008

CVSS
—
EPSS
12%
Percentile
96.1
In the wild
Unconfirmed
What it is

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.11843 · 96.1th percentile
Published
2008-03-28T23:00Z
EPSS history
Timeline
  • 28 MAR 23:00Z
    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request…
    cvelistv5