CVE-2024-42489: Pro Macros Remote Code Execution via Viewpdf and similar macros
Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the CKEditor.HTMLConverter page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42489?
CVE-2024-42489 has been classified with a high severity due to potential remote code execution.
How do I fix CVE-2024-42489?
To fix CVE-2024-42489, update the Pro Macros to a version above 1.10.1 where the vulnerability is addressed.
Who is affected by CVE-2024-42489?
Any user with view rights on the CKEditor.HTMLConverter page or edit or comment rights on any page is affected by CVE-2024-42489.
What are the consequences of exploiting CVE-2024-42489?
Exploiting CVE-2024-42489 can lead to remote code execution, compromising the security of the affected system.
Which versions of Pro Macros are vulnerable to CVE-2024-42489?
Pro Macros versions between 1.0 and 1.10.1, inclusive, are vulnerable to CVE-2024-42489.