CVE-2024-52300: macro-pdfviewer has a XSS through the width parameter
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52300?
CVE-2024-52300 is classified as a high severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2024-52300?
To fix CVE-2024-52300, upgrade to a version of the XWiki PDF Viewer Macro that is 2.5.6 or later.
Who is affected by CVE-2024-52300?
Any user with the ability to edit a page in XWiki using the affected version of the PDF Viewer Macro is at risk for CVE-2024-52300.
What are the impacts of CVE-2024-52300?
CVE-2024-52300 can lead to XSS attacks that compromise the confidentiality, integrity, and availability of the entire XWiki installation.
Is there a workaround for CVE-2024-52300?
Currently, the best resolution for CVE-2024-52300 is to upgrade the software, as no specific workaround has been documented.