CVE-2024-30263

The PDF Viewer macro can be used to view PDF attachments with restricted access

Severity Score

7.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.

macro-pdfviewer es un macro de visor de PDF para XWiki que utiliza Mozilla pdf.js. Los usuarios con derechos de edición pueden acceder a archivos adjuntos PDF restringidos utilizando el macro Visor de PDF, simplemente pasando la URL del archivo adjunto como el valor del parámetro ``archivo``. Los usuarios con derechos de visualización pueden acceder a archivos adjuntos PDF restringidos si se muestran en páginas públicas donde se llama a la macro del Visor de PDF utilizando la URL del archivo adjunto en lugar de su referencia. Esta vulnerabilidad ha sido parcheada en la versión 2.5.1.

*Credits: N/A

CVSS Scores

GitHubv3.1 7.7

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-03-26 CVE Reserved
2024-04-04 CVE Published
2024-04-05 EPSS Updated
2024-08-21 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (2)

URL	Tag	Source
https://github.com/xwikisas/macro-pdfviewer/issues/49	X_refsource_misc
https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xwikisas Search vendor "Xwikisas"		Macro-pdfviewer Search vendor "Xwikisas" for product "Macro-pdfviewer"				<= 2.5.0 Search vendor "Xwikisas" for product "Macro-pdfviewer" and version " <= 2.5.0"		en		Affected