Critical severity · published Nov 13, 2024
CVE-2024-52300
macro-pdfviewer has a XSS through the width parameter
9.0
CVSS
0.5%
EPSS
No
On KEV
Description
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
macro-pdfviewer · xwikisas
< 2.5.6 · source: vendor
PV
Pdf Viewer Macro · Xwiki
before 2.5.6 · source: NVD
MP
Macro Pdfviewer · Xwikisas
before 2.5.6 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52300
Third Party Advisory
https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6g
More from macro-pdfviewer
7.5
CVE-2024-52298
macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author
7.5
CVE-2024-52299
The PDF viewer macro allows accessing any attachment without access right checks