Tickets :: Comment on [#5892] Linked attachment feature vulnerability

* Your Email Address
* Spam protection	Enter the letters below: . ..___..___.. .. . \|__\| \| \| \|_/ \| \| \| \| \| \| \| \\|__\|
Comment	> By exploiting the jar: protocol feature of Mozilla Firefox and the > fact that the Imp Web Client allows things like > "https://mail.server/horde/imp/attachment.php?u=user&t=4827164921&f=example.jpg", it's possible to execute various XSS attacks. For example: > "jar:https://mail.server/horde/imp/attachment.php?u=user&t=4827164921&f=example.jar!/evil.htm".
Attachment
Watch this ticket