We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Reserved 2024-10-28 | Published 2024-10-29 | Updated 2024-10-29 | Assigner mozillaXSS due to Content-Disposition being ignored in multipart/x-mixed-replace response
Masato Kinugawa
bugzilla.mozilla.org/show_bug.cgi?id=1914521
www.mozilla.org/security/advisories/mfsa2024-55/
www.mozilla.org/security/advisories/mfsa2024-56/
www.mozilla.org/security/advisories/mfsa2024-58/
www.mozilla.org/security/advisories/mfsa2024-59/
Support options
