Vulnerability · Published Nov 13, 2024 · Assigned by GitHub_M
CVE-2024-52300macro-pdfviewer has a XSS through the width parameter
Critical 9.1
In plain English
A critical-severity security flaw in macro-pdfviewer from xwikisas. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwikisas | macro-pdfviewer | < 2.5.6 |
Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H