Some security vulnerability scanners as Ratproxy detects a vulnerability called "MIME type mismatch on image file". Thanks to the CAPEC project we can see that Cross-Site Scripting Using MIME Type Mismatch is possible, but the explanation shown is not clear for me.
Can you explain how exactly can an attacker exploit this kind of vulnerability with an example?
Is it needed that the web client (e.g. the browser) has also a vulnerability to exploit this web application vulnerability or it completely depends of the web application?