CVE-2008-5554: XSS
The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks, as demonstrated by the (1) Location and (2) Set-Cookie HTTP headers. NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5554?
CVE-2008-5554 is considered a high severity vulnerability due to its potential to allow remote attackers to bypass XSS protections.
How do I fix CVE-2008-5554?
To fix CVE-2008-5554, upgrade to a newer version of Internet Explorer that is not affected by this vulnerability.
What type of attacks can CVE-2008-5554 allow?
CVE-2008-5554 can allow attackers to conduct cross-site scripting (XSS) and redirection attacks by exploiting the XSS filter.
Which versions of Internet Explorer are affected by CVE-2008-5554?
CVE-2008-5554 specifically affects Microsoft Internet Explorer 8.0 Beta 2.
What is the cause of the vulnerability in CVE-2008-5554?
The cause of CVE-2008-5554 is the improper handling of certain HTTP headers after a CRLF sequence in a URI by the XSS filter.