CVE-2025-55030CWE-640

CVE-2025-55030

Medium · published August 20, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2025-08-20T01:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox< 142.0142.0
References (2)
https://bugzilla.mozilla.org/show_bug.cgi?id=1976304 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-68/ · [email protected]
EPSS history
Timeline
  • 19 AUG 20:52Z
    Content-Disposition headers incorrectly ignored for some MIME types
    cvelistv5