CVE-2024-42489 - CVE House
Back to Database
Status published Critical CVE-2024-42489

Pro Macros Remote Code Execution via Viewpdf and similar macros

Vulnerability Description

Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-42489

Credits & Attribution

No credits recorded in the NVD database.

References

More from xwikisas

View All →
CVE-2025-65089
XWiki view file macro: User can view content of office file without view rights on the attachment
Medium 6.8
CVE-2025-65036
XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro
High 8.3
CVE-2025-55730
XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro
Critical 10
CVE-2025-55729
XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro
Critical 10
CVE-2025-55728
XWiki Remote Macros vulnerable to remote code execution using the panel macro
Critical 10

Affected Vendor

Affected Software

xwiki-pro-macros
Vulnerable Versions:
>= 1.0, < 1.10.1

Timeline

Official Publish: August 12th, 2024
Last Modified: August 13th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-74

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection