CVE-2008-1545: Input Validation
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1545?
CVE-2008-1545 is considered a high severity vulnerability due to its potential for causing HTTP request splitting and smuggling attacks.
How do I fix CVE-2008-1545?
To fix CVE-2008-1545, upgrading to a more secure version of Internet Explorer or applying Microsoft's security patches is recommended.
What types of attacks can be performed using CVE-2008-1545?
CVE-2008-1545 allows attackers to conduct HTTP request splitting and HTTP request smuggling attacks.
Which versions of Internet Explorer are affected by CVE-2008-1545?
CVE-2008-1545 specifically affects Internet Explorer version 7.0 and 7.0.5730.11.
What is the cause of CVE-2008-1545?
CVE-2008-1545 is caused by the setRequestHeader method not restricting the Transfer-Encoding HTTP request header.