CVE-2024-42489: Pro Macros Remote Code Execution via Viewpdf and similar macros
First published: Mon Aug 12 2024(Updated: )
Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xwiki Pro Macros | >=1.0<1.10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-cfq3-q227-7j65
- https://github.com/xwikisas/xwiki-pro-macros/commit/199553c84901999481a20614f093af2d57970eba
- https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Viewpdf.xml#L265-L267
Frequently Asked Questions
What is the severity of CVE-2024-42489?
CVE-2024-42489 has been classified with a high severity due to potential remote code execution.
How do I fix CVE-2024-42489?
To fix CVE-2024-42489, update the Pro Macros to a version above 1.10.1 where the vulnerability is addressed.
Who is affected by CVE-2024-42489?
Any user with view rights on the CKEditor.HTMLConverter page or edit or comment rights on any page is affected by CVE-2024-42489.
What are the consequences of exploiting CVE-2024-42489?
Exploiting CVE-2024-42489 can lead to remote code execution, compromising the security of the affected system.
Which versions of Pro Macros are vulnerable to CVE-2024-42489?
Pro Macros versions between 1.0 and 1.10.1, inclusive, are vulnerable to CVE-2024-42489.
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/xwiki
- canonical/xwiki pro macros
- version/xwiki pro macros/1.0