CVE-2024-52300: falha crítica em xwikisas macro-pdfviewer
macro-pdfviewer has a XSS through the width parameter
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.5%
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
xwikisas · macro-pdfviewerCVEs relacionadas — xwikisas macro-pdfviewer
No mesmo produto, das mais perigosas para as menos.
CVE-2024-52298HIGHmacro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last authorEPSS 0.7%CVE-2024-30263HIGHThe PDF Viewer macro can be used to view PDF attachments with restricted accessEPSS 0.5%CVE-2024-52299HIGHThe PDF viewer macro allows accessing any attachment without access right checksEPSS 0.5%