CVE-2008-5556 — Cross-site Scripting in Microsoft Internet Explorer

CWE-79 — Cross-site Scripting2 documents2 sources
Severity
4.3MEDIUMNVD
EPSS
11.1%
top 6.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Internet Explorer
Timeline
PublishedDec 12
Latest updateMay 14

Description

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are encoded with utf-7, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting crafted utf-7 content. NOTE: the vendor reportedly disputes this issue, stating "Behaviour is by design.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-4g9v-p2mj-pg7w: ** DISPUTED ** The XSS Filter in Microsoft Internet Explorer 8↗2022-05-14
▶
CVE-2008-5556 — Cross-site Scripting in Microsoft | cvebase