CVE-2024-52300: fallo crítico en xwikisas macro-pdfviewer
macro-pdfviewer has a XSS through the width parameter
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.5%
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
xwikisas · macro-pdfviewerCVEs relacionadas — xwikisas macro-pdfviewer
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-52298HIGHmacro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last authorEPSS 0.7%CVE-2024-30263HIGHThe PDF Viewer macro can be used to view PDF attachments with restricted accessEPSS 0.5%CVE-2024-52299HIGHThe PDF viewer macro allows accessing any attachment without access right checksEPSS 0.5%