CVE-2025-55030

Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1976304	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-68/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*

History

No history.

Information

Published : 2025-08-19 21:15

Updated : 2026-06-17 09:41

NVD link : CVE-2025-55030

Mitre link : CVE-2025-55030

CVE.ORG link : CVE-2025-55030

JSON object : View

Products Affected

mozilla

firefox

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2025-55030", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55030", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-20T14:02:11.419764Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox for iOS", "versions": [{"status": "unaffected", "version": "142", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2025-08-19T21:15:28.210", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1976304", "tags": ["Issue Tracking", "Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-68/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142."}, {"lang": "es", "value": "Firefox para iOS no respetar\u00eda un encabezado Content-Disposition de tipo Attachment y mostrar\u00eda incorrectamente el contenido en l\u00ednea en lugar de descargarlo, lo que potencialmente permitir\u00eda ataques XSS. Esta vulnerabilidad afecta a Firefox para iOS < 142."}], "lastModified": "2026-06-17T09:41:07.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "7EE372C2-99CB-45F5-9F6B-0862D02C6374", "versionEndExcluding": "142.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}