CVE-2024-30263: The PDF Viewer macro can be used to view PDF attachments with restricted access
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the file parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30263?
CVE-2024-30263 has been classified as a high severity vulnerability due to the ability of unauthorized users to access restricted PDF attachments.
How do I fix CVE-2024-30263?
To fix CVE-2024-30263, upgrade the XWiki PDF Viewer Macro to version 2.5.1 or later.
Who is affected by CVE-2024-30263?
Users with edit rights in XWiki are affected by CVE-2024-30263 as they can exploit the vulnerability to access restricted PDFs.
What impact does CVE-2024-30263 have on data security?
CVE-2024-30263 potentially exposes sensitive PDF attachments to unauthorized users, compromising data confidentiality.
Is there a workaround for CVE-2024-30263 until I can apply a fix?
Currently, the recommended solution is to upgrade to a secure version, as there are no known workarounds for CVE-2024-30263.