CVE-2024-10461 — Cross-site Scripting in Mozilla Firefox
Severity
6.1MEDIUMNVD
OSV7.5
EPSS
0.9%
top 23.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 29
Latest updateFeb 2
Description
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages7 packages
🔴Vulnerability Details
4CVEList▶
CVE-2024-10461: In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which↗2024-10-29
GHSA▶
GHSA-679j-4q32-w85w: In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which↗2024-10-29
OSV▶
CVE-2024-10461: In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which↗2024-10-29