CVE-2024-30263 - CVE House

Back to Database

Status published High CVE-2024-30263

The PDF Viewer macro can be used to view PDF attachments with restricted access

7.7 CVSS

Vulnerability Description

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-30263

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from xwikisas

View All →

XWiki view file macro: User can view content of office file without view rights on the attachment

XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro

XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro

XWiki Remote Macros vulnerable to remote code execution using the panel macro

Affected Vendor

xwikisas

View all reports →

Affected Software

macro-pdfviewer

Vulnerable Versions:

<= 2.5.0

Timeline

Official Publish: April 4th, 2024

Last Modified: August 21st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel