CVE-2008-5555

Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which allows remote…

published December 12, 2008

CVSS
—
EPSS
13%
Percentile
96.2
In the wild
Unconfirmed
What it is

Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which allows remote attackers to bypass the product's XSS Filter protection mechanism, and conduct XSS and cross-domain attacks, by injecting this header after a CRLF sequence, related to "XDomainRequest Allowed Injection (XAI)." NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.12526 · 96.2th percentile
Published
2008-12-12T18:13Z
EPSS history
Timeline
  • 12 DEC 18:13Z
    Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which allows remote…
    cvelistv5