XSS in Microsoft Office
CVE-2008-4020
Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a "Content-Disposition: attachment" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka "Vulnerability in Content-Disposition Header Vulnerability."
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.244 (97.6th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Office — versions xp
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@microsoft.com (vdb-entry, x_refsource_VUPEN)
- secure@microsoft.com (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- secure@microsoft.com (vdb-entry, x_refsource_XF)
- secure@microsoft.com (x_refsource_HP, vendor-advisory)
- secure@microsoft.com (x_refsource_JVNDB, third-party-advisory)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)
- secure@microsoft.com (vdb-entry, x_refsource_XF)
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (x_refsource_JVN, third-party-advisory)
- secure@microsoft.com (vdb-entry, x_refsource_SECTRACK)