CVE-2008-4032
Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions, which allows remote attackers to cause a denial of service (server load), obtain sensitive information, and "create scripts that would run in the context of the site" via requests to administrative URIs, aka "Access Control Vulnerability."
Key facts
- CVSS score
- 7.5 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P- Weakness (CWE)
- CWE-287
- EPSS score
- 47.9% (99th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2008-4017)
- Published
- December 10, 2008
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2008-4017 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- microsoft / office sharepoint server
- microsoft / office sharepoint server
- microsoft / office sharepoint server
- microsoft / office sharepoint server
- microsoft / search server
- microsoft / search server
References
- http://secunia.com/advisories/33063
- http://www.securitytracker.com/id?1021367
- http://www.us-cert.gov/cas/techalerts/TA08-344A.html(US Government Resource)
- http://www.vupen.com/english/advisories/2008/3389
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-077
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5774
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain