CVE-2009-0419: Medium severity Microsoft XML Core Services vulnerability
Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-4033.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0419?
CVE-2009-0419 is classified as a moderate severity vulnerability.
How do I fix CVE-2009-0419?
To fix CVE-2009-0419, ensure that you apply the latest security updates for Microsoft XML Core Services and related products.
What software is affected by CVE-2009-0419?
CVE-2009-0419 affects Microsoft XML Core Services, as well as products like Microsoft Expression Web and Internet Explorer 6 and 7.
What type of attack is associated with CVE-2009-0419?
CVE-2009-0419 allows attackers to exploit web pages to obtain sensitive information from cookies via XMLHttpRequest.
Is CVE-2009-0419 still a risk today?
While CVE-2009-0419 was relevant in its time, its significance is limited today due to the end of life for the affected software versions.