Threat Investigation
Request a demo

CVE-2008-5554

Medium

Description

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks, as demonstrated by the (1) Location and (2) Set-Cookie HTTP headers. NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."

SeverityMedium
CVSS4.3
Exploit probability—
ProductMicrosoft Internet Explorer
PublishedDec 12, 2008
First seenDec 12, 2008

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

ProductAffected versionsFixed in
microsoft internet_explorer8—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.