CVSS: 7.5EPSS: %CPEs: 1EXPL: 0CVE-2024-52298 – macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author
https://notcve.org/view.php?id=CVE-2024-52298
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs to provide the reference to a PDF file to the macro. To obtain the reference of the desired attachment, the attacker can access the Page Index, Attachments tab. Even if the UI shows N/A, the user can inspect the page and check the HTTP request that fetches the live data entries. • https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-hph4-7j37-7c97 • CWE-615: Inclusion of Sensitive Information in Source Code Comments •
CVSS: 7.5EPSS: %CPEs: 1EXPL: 0CVE-2024-52299 – The PDF viewer macro allows accessing any attachment without access right checks
https://notcve.org/view.php?id=CVE-2024-52299
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6. • https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-522m-m242-jr9p • CWE-340: Generation of Predictable Numbers or Identifiers •
CVSS: 9.0EPSS: %CPEs: 1EXPL: 0CVE-2024-52300 – macro-pdfviewer has a XSS through the width parameter
https://notcve.org/view.php?id=CVE-2024-52300
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6. • https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6g • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30263 – The PDF Viewer macro can be used to view PDF attachments with restricted access
https://notcve.org/view.php?id=CVE-2024-30263
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1. macro-pdfviewer es un macro de visor de PDF para XWiki que utiliza Mozilla pdf.js. Los usuarios con derechos de edición pueden acceder a archivos adjuntos PDF restringidos utilizando el macro Visor de PDF, simplemente pasando la URL del archivo adjunto como el valor del parámetro ``archivo``. • https://github.com/xwikisas/macro-pdfviewer/issues/49 https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •