by Kastro
Paper/Archive/CVE-2024-52300

CVE-2024-52300

xwikisas macro-pdfviewer — macro-pdfviewer has a XSS through the width parameter

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 39.9.399 × 208.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.

Affected

ProductAffectedFixed inSource
macro-pdfviewer< 2.5.6–CNA
macro_pdfviewer< 2.5.62.5.6CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6g