High severity · published Apr 4, 2024
CVE-2024-30263
The PDF Viewer macro can be used to view PDF attachments with restricted access
7.7
CVSS
0.5%
EPSS
No
On KEV
Description
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
macro-pdfviewer · xwikisas
<= 2.5.0 · source: vendor
MP
Macro Pdfviewer · Xwikisas
through 2.5.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-30263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-30263
github.com
https://github.com/xwikisas/macro-pdfviewer/issues/49
github.com
https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f
More from macro-pdfviewer
9.0
CVE-2024-52300
macro-pdfviewer has a XSS through the width parameter
7.5
CVE-2024-52298
macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author
7.5
CVE-2024-52299
The PDF viewer macro allows accessing any attachment without access right checks