CVE-2024-52298 - CVE House
Back to Database
Status published High CVE-2024-52298

macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

Vulnerability Description

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs to provide the reference to a PDF file to the macro. To obtain the reference of the desired attachment, the attacker can access the Page Index, Attachments tab. Even if the UI shows N/A, the user can inspect the page and check the HTTP request that fetches the live data entries. The attachment URL is available in the returned JSON for all attachments, including protected ones and allows getting the necessary values. This vulnerability is fixed in version 2.5.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52298

Credits & Attribution

No credits recorded in the NVD database.

References

More from xwikisas

View All →
CVE-2025-65089
XWiki view file macro: User can view content of office file without view rights on the attachment
Medium 6.8
CVE-2025-65036
XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro
High 8.3
CVE-2025-55730
XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro
Critical 10
CVE-2025-55729
XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro
Critical 10
CVE-2025-55728
XWiki Remote Macros vulnerable to remote code execution using the panel macro
Critical 10

Affected Vendor

Affected Software

macro-pdfviewer
Vulnerable Versions:
>= 1.6.2, < 2.5.6

Timeline

Official Publish: November 13th, 2024
Last Modified: November 13th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-615

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.