PT-2024-23306 · Mozilla · Pdf.Js

Highchiuchiusorin · Published 2024-04-04 · Updated 2024-04-04 · CVE-2024-30263

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macro-pdfviewer versions prior to 2.5.1

Description The macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro by passing the attachment URL as the value of the file parameter. Additionally, users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the PDF Viewer macro for users with edit and view rights until the update is applied. Avoid using the file parameter in the PDF Viewer macro to access restricted PDF attachments until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-30263

GHSA-93QQ-2H34-G29F

Affected Products

Pdf.Js

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30263.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-30263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30263 · Security Note
• https://github.com/xwikisas/macro-pdfviewer/issues/49 · Note
• https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f · Note
• https://t.me/cvenotify/75763 · Telegram Post
• https://t.me/cvenotify/75768 · Telegram Post