PT-2024-8494 · Mozilla · Pdf.Js

Chiuchiusorin · Published 2024-11-13 · Updated 2024-11-18 · CVE-2024-52300

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macro-pdfviewer versions prior to 2.5.6

Description The issue is related to the macro-pdfviewer PDF viewer macro for XWiki, which uses Mozilla pdf.js. The width parameter of the PDF viewer macro is not properly escaped, allowing for cross-site scripting (XSS) attacks for any user who can edit a page. This can impact the confidentiality, integrity, and availability of the whole XWiki installation when an admin visits the page with the malicious code.

Recommendations For versions prior to 2.5.6, update to version 2.5.6 to mitigate the security vulnerability. As a temporary workaround, consider restricting access to the width parameter in the PDF viewer macro until a patch is available. Avoid using the width parameter in the affected macro until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2024-10054

CVE-2024-52300

GHSA-84WX-6VFP-5M6G

Affected Products

Pdf.Js

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52300.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52300 · Security Note
• https://bdu.fstec.ru/vul/2024-10054 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52300 · Vendor Advisory
• https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6g · Note
• https://twitter.com/VulmonFeeds/status/1856785143412801576 · Twitter Post
• https://t.me/cvedetector/10831 · Telegram Post
• https://store.xwiki.com/xwiki/bin/view/Extension/PDFViewerMacro · Note
• https://twitter.com/CveFindCom/status/1856827288542761239 · Twitter Post
• https://twitter.com/CVEnew/status/1856726585904115876 · Twitter Post