Vulnerability · Published Apr 4, 2024 · Assigned by GitHub_M

CVE-2024-30263The PDF Viewer macro can be used to view PDF attachments with restricted access

High 7.7

In plain English

A high-severity information exposure in macro-pdfviewer from xwikisas. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.

Affected products (as reported)

Vendor	Product	Versions
xwikisas	macro-pdfviewer	<= 2.5.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f x_refsource_CONFIRM
https://github.com/xwikisas/macro-pdfviewer/issues/49 x_refsource_MISC