{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \"Content-Disposition: attachment\" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka \"Vulnerability in Content-Disposition Header Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados(XSS) en Microsoft Office XP SP3, permite a atacantes remotos inyectar secuencias de comandos Web o HTML mediante un documento que contiene una cabecera \"Content-Disposition: attachment\" y se accede a ella a trav\u00e9s de un cdo: URL; esto traduce el contexto en vez de mostrar un cuadro de di\u00e1logo de Descarga de Fichero. Tambi\u00e9n se conoce como \"Vulnerabilidad en Cabeceras Content-Disposition\"."
    }
  ],
  "id": "CVE-2008-4020",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-10-15T00:12:15.957",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "http://jvn.jp/en/jp/JVN55410403/index.html"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000070.html"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32138"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/31693"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.securitytracker.com/id?1021045"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-288A.html"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.vupen.com/english/advisories/2008/2807"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-056"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45546"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45550"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5969"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvn.jp/en/jp/JVN55410403/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000070.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32138"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/31693"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1021045"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-288A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/2807"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-056"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45546"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45550"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5969"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Office XP Service Pack 3.",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 affectant la gestion du protocole CDO (Collaboration\nData Objects) de Microsoft Office permet \u00e0 une personne malveillante de\nporter atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es via une adresse\nr\u00e9ticulaire CDO sp\u00e9cialement con\u00e7ue. Cette vuln\u00e9rabilit\u00e9 permet via le\nnavigateur du client de divulguer des informations, d\u0027usurper du contenu\nou d\u0027entreprendre des actions que l\u0027utilisateur pourrait effectuer sur\nle site Web affect\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS08-056 de Microsoft pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-4020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4020"
    }
  ],
  "initial_release_date": "2008-10-15T00:00:00",
  "last_revision_date": "2008-10-15T00:00:00",
  "links": [],
  "reference": "CERTA-2008-AVI-497",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-10-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 affectant Microsoft Office permet \u00e0 une personne\nmalintentionn\u00e9e de porter atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Office",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS08-056 du 14 octobre 2008",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS08-056.mspx"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-4020"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-10-15T00:12:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \"Content-Disposition: attachment\" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka \"Vulnerability in Content-Disposition Header Vulnerability.\"",
  "id": "GHSA-hmhj-jwx3-6q6x",
  "modified": "2022-05-02T00:05:57Z",
  "published": "2022-05-02T00:05:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4020"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-056"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45546"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45550"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5969"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN55410403/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000070.html"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32138"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/31693"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1021045"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-288A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2807"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000070.html",
  "dc:date": "2008-10-22T17:49+09:00",
  "dcterms:issued": "2008-10-22T17:49+09:00",
  "dcterms:modified": "2008-10-22T17:49+09:00",
  "description": "Internet Explorer is vulnerable in handling CDO (Collaboration Data Objects) protocol, which allows the download dialog box to be bypassed.\r\n\r\nWhen Internet Explorer (IE) accesses a website using CDO (Collaboration Data Objects), IE processes the contents as CDO data, ignoring their actual content types, and IE does not properly handle the Content-Disposition header field.\r\nThis could cause a download dialog box not to be displayed prior to downloading. The CDO protocol handler is included in an Office component, and Microsoft provides the fix for this component.\r\n\r\nNetAgent Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the Microsoft Corporation under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000070.html",
  "sec:cpe": {
    "#text": "cpe:/a:microsoft:office",
    "@product": "Microsoft Office",
    "@vendor": "Microsoft Corporation",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-000070",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN55410403/index.html",
      "@id": "JVN#55410403",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/tr/TRTA08-288A/",
      "@id": "TRTA08-288A",
      "@source": "JVNTR"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4020",
      "@id": "CVE-2008-4020",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4020",
      "@id": "CVE-2008-4020",
      "@source": "NVD"
    },
    {
      "#text": "http://www.us-cert.gov/cas/alerts/SA08-288A.html",
      "@id": "SA08-288A",
      "@source": "CERT-SA"
    },
    {
      "#text": "http://www.us-cert.gov/cas/techalerts/TA08-288A.html",
      "@id": "TA08-288A",
      "@source": "CERT-TA"
    },
    {
      "#text": "http://secunia.com/advisories/32138/",
      "@id": "SA32138",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/31693",
      "@id": "31693",
      "@source": "BID"
    },
    {
      "#text": "http://www.frsirt.com/english/advisories/2008/2807",
      "@id": "FrSIRT/ADV-2008-2807",
      "@source": "FRSIRT"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000070.html",
      "@id": "JVNDB-2008-000070",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Internet Explorer vulnerable in handling CDO protocol"
}

{
  "GSD": {
    "alias": "CVE-2008-4020",
    "description": "Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \"Content-Disposition: attachment\" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka \"Vulnerability in Content-Disposition Header Vulnerability.\"",
    "id": "GSD-2008-4020"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2008-4020"
      ],
      "details": "Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \"Content-Disposition: attachment\" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka \"Vulnerability in Content-Disposition Header Vulnerability.\"",
      "id": "GSD-2008-4020",
      "modified": "2023-12-13T01:22:59.908279Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2008-4020",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \"Content-Disposition: attachment\" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka \"Vulnerability in Content-Disposition Header Vulnerability.\""
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "ADV-2008-2807",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2008/2807"
          },
          {
            "name": "32138",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/32138"
          },
          {
            "name": "office-cdo-xss(45546)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45546"
          },
          {
            "name": "SSRT080143",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2"
          },
          {
            "name": "JVNDB-2008-000070",
            "refsource": "JVNDB",
            "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000070.html"
          },
          {
            "name": "MS08-056",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-056"
          },
          {
            "name": "HPSBST02379",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2"
          },
          {
            "name": "win-ms08kb957699-update(45550)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45550"
          },
          {
            "name": "oval:org.mitre.oval:def:5969",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5969"
          },
          {
            "name": "JVN#55410403",
            "refsource": "JVN",
            "url": "http://jvn.jp/en/jp/JVN55410403/index.html"
          },
          {
            "name": "1021045",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1021045"
          },
          {
            "name": "31693",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/31693"
          },
          {
            "name": "TA08-288A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA08-288A.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2008-4020"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \"Content-Disposition: attachment\" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka \"Vulnerability in Content-Disposition Header Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1021045",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1021045"
            },
            {
              "name": "32138",
              "refsource": "SECUNIA",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/32138"
            },
            {
              "name": "31693",
              "refsource": "BID",
              "tags": [
                "Patch"
              ],
              "url": "http://www.securityfocus.com/bid/31693"
            },
            {
              "name": "TA08-288A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA08-288A.html"
            },
            {
              "name": "SSRT080143",
              "refsource": "HP",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2"
            },
            {
              "name": "JVN#55410403",
              "refsource": "JVN",
              "tags": [],
              "url": "http://jvn.jp/en/jp/JVN55410403/index.html"
            },
            {
              "name": "JVNDB-2008-000070",
              "refsource": "JVNDB",
              "tags": [],
              "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000070.html"
            },
            {
              "name": "ADV-2008-2807",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2008/2807"
            },
            {
              "name": "win-ms08kb957699-update(45550)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45550"
            },
            {
              "name": "office-cdo-xss(45546)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45546"
            },
            {
              "name": "oval:org.mitre.oval:def:5969",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5969"
            },
            {
              "name": "MS08-056",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-056"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2018-10-12T21:48Z",
      "publishedDate": "2008-10-15T00:12Z"
    }
  }
}