An attacker could leverage social engineering or email spoofing to interact with a user and convince them to open the malicious file.
CVE Solution: Update
JSONP
An attacker can inject malicious script code in the page parameter to execute arbitrary script code in the browser of an unsuspecting user through this