Macro Pdfviewer
Approved changes feed: RSS · Atom
cpe:2.3:a:xwikisas:macro_pdfviewer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Xwikisas (04e6a3b8-a695-59f7-83a9-7efbff26e2a0) |
|---|---|
| Product | Macro Pdfviewer (551fd617-3f98-57bb-acb2-510d5ee7d015) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-52300 |
vulnerable | 2026-06-08 06:52:14.747670 |
macro-pdfviewer has a XSS through the width parameter
CRITICAL (9.1)
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
Published: 2024-11-13T15:24:59.125Z
Updated: 2024-11-13T19:10:59.349Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52299 |
vulnerable | 2026-06-08 06:52:14.747145 |
The PDF viewer macro allows accessing any attachment without access right checks
HIGH (7.5)
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.
Published: 2024-11-13T15:29:07.107Z
Updated: 2024-11-14T13:58:59.615Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52298 |
vulnerable | 2026-06-08 06:52:14.745011 |
macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author
HIGH (7.5)
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs to provide the reference to a PDF file to the macro. To obtain the reference of the desired attachment, the attacker can access the Page Index, Attachments tab. Even if the UI shows N/A, the user can inspect the page and check the HTTP request that fetches the live data entries. The attachment URL is available in the returned JSON for all attachments, including protected ones and allows getting the necessary values. This vulnerability is fixed in version 2.5.6.
Published: 2024-11-13T15:42:42.501Z
Updated: 2024-11-13T19:06:04.381Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-30263 |
vulnerable | 2026-06-08 06:35:29.369629 |
The PDF Viewer macro can be used to view PDF attachments with restricted access
HIGH (7.7)
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.
Published: 2024-04-04T16:51:44.212Z
Updated: 2024-08-21T14:35:52.094Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.