Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \Content-Disposition: attachment\ header and is accessed through a cdo: URL which renders the content instead of raising a File Download dialog box aka \Vulnerability in Content-Disposition Header Vulnerability.\