CVE-2024-10461: XSS

Q: What is the severity of CVE-2024-10461?

CVE-2024-10461 is considered a medium severity vulnerability due to its potential to allow XSS attacks.

Q: How do I fix CVE-2024-10461?

To fix CVE-2024-10461, update affected software to Mozilla Firefox version 132 or Thunderbird version 132, and Firefox ESR and Thunderbird versions 128.4.

Q: Which versions are affected by CVE-2024-10461?

CVE-2024-10461 affects Firefox versions below 132, Firefox ESR versions below 128.4, and Thunderbird versions below 132.

Q: What types of attacks can exploit CVE-2024-10461?

CVE-2024-10461 can be exploited for cross-site scripting (XSS) attacks due to improper handling of response headers.

Q: Who is affected by CVE-2024-10461?

Users of Mozilla Firefox, Firefox ESR, and Thunderbird prior to the specified safe versions are at risk from CVE-2024-10461.

Published Oct 29, 2024

Updated

In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Other sources

In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks.

— Mozilla

Affected Software

17 affected componentsFixes available

Mozilla Thunderbird<128.4

128.4

Mozilla Thunderbird<132

132

Mozilla Firefox<128.4.0

Mozilla Firefox<132.0

Mozilla Thunderbird<128.4.0

Mozilla Thunderbird>=129.0<132.0

Mozilla Firefox<132

132

Mozilla Firefox ESR<128.4

128.4

debian/firefox-esr<128.4.0esr-1~deb12u1

128.4.0esr-1~deb12u1

debian/firefox-esr<128.4.0esr-1

128.4.0esr-1

debian/firefox-esr<128.4.0esr-1

128.4.0esr-1

debian/thunderbird<1:128.4.0esr-1~deb12u1

1:128.4.0esr-1~deb12u1

debian/thunderbird<1:128.4.0esr-1

1:128.4.0esr-1

debian/thunderbird<1:128.4.0esr-1

1:128.4.0esr-1

debian/firefox

159.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 132.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.4.0esr-1~deb11u1Fixed in 128.4.0esr-1~deb12u1Fixed in 128.4.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.4.0esr-1~deb11u1Fixed in 1:128.4.0esr-1~deb12u1Fixed in 1:128.4.0esr-1Fixed in 1:128.4.2esr-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 128.4
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 132
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 132
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 128.4

Event History

Oct 29, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionWeakness

Data Sourced

via Red Hat·01:01 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·01:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-10461?

CVE-2024-10461 is considered a medium severity vulnerability due to its potential to allow XSS attacks.

How do I fix CVE-2024-10461?

To fix CVE-2024-10461, update affected software to Mozilla Firefox version 132 or Thunderbird version 132, and Firefox ESR and Thunderbird versions 128.4.

Which versions are affected by CVE-2024-10461?

CVE-2024-10461 affects Firefox versions below 132, Firefox ESR versions below 128.4, and Thunderbird versions below 132.

What types of attacks can exploit CVE-2024-10461?

CVE-2024-10461 can be exploited for cross-site scripting (XSS) attacks due to improper handling of response headers.

Who is affected by CVE-2024-10461?

Users of Mozilla Firefox, Firefox ESR, and Thunderbird prior to the specified safe versions are at risk from CVE-2024-10461.

CVE-2024-10461: XSS

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-10461?

How do I fix CVE-2024-10461?

Which versions are affected by CVE-2024-10461?

What types of attacks can exploit CVE-2024-10461?

Who is affected by CVE-2024-10461?

Company

Resources

Contact