CVE-2024-52299
The PDF viewer macro allows accessing any attachment without access right checks
- State
- Published
- Severity
- 7.5 High
- Published
- Nov 13, 2024
- Updated
- Nov 14, 2024
- Reserved
- Nov 6, 2024
Description
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
Weaknesses
- CWE-340 Generation of Predictable Numbers or Identifiers
Affected Products
| Product | Versions |
|---|---|
macro-pdfviewerxwikisas |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.