cve-2024-30263
Vulnerability from cvelistv5
Published
2024-04-04 16:51
Modified
2024-08-21 14:35
Severity ?
EPSS score ?
Summary
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | xwikisas | macro-pdfviewer |
Version: <= 2.5.0 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:32:07.062Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f"
},
{
"name": "https://github.com/xwikisas/macro-pdfviewer/issues/49",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/xwikisas/macro-pdfviewer/issues/49"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:xwikisas:macro_pdfviewer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "macro_pdfviewer",
"vendor": "xwikisas",
"versions": [
{
"lessThanOrEqual": "2.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-30263",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-21T14:32:28.445564Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-21T14:35:52.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macro-pdfviewer",
"vendor": "xwikisas",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-04T16:51:44.212Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f"
},
{
"name": "https://github.com/xwikisas/macro-pdfviewer/issues/49",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xwikisas/macro-pdfviewer/issues/49"
}
],
"source": {
"advisory": "GHSA-93qq-2h34-g29f",
"discovery": "UNKNOWN"
},
"title": "The PDF Viewer macro can be used to view PDF attachments with restricted access"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-30263",
"datePublished": "2024-04-04T16:51:44.212Z",
"dateReserved": "2024-03-26T12:52:00.935Z",
"dateUpdated": "2024-08-21T14:35:52.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-30263\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-04-04T17:15:10.320\",\"lastModified\":\"2024-11-21T09:11:34.797\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.\"},{\"lang\":\"es\",\"value\":\"macro-pdfviewer es un macro de visor de PDF para XWiki que utiliza Mozilla pdf.js. Los usuarios con derechos de edici\u00f3n pueden acceder a archivos adjuntos PDF restringidos utilizando el macro Visor de PDF, simplemente pasando la URL del archivo adjunto como el valor del par\u00e1metro ``archivo``. Los usuarios con derechos de visualizaci\u00f3n pueden acceder a archivos adjuntos PDF restringidos si se muestran en p\u00e1ginas p\u00fablicas donde se llama a la macro del Visor de PDF utilizando la URL del archivo adjunto en lugar de su referencia. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 2.5.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/xwikisas/macro-pdfviewer/issues/49\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/xwikisas/macro-pdfviewer/issues/49\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.