CVE-2024-52299

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-52299
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52299.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-52299
Aliases
  • GHSA-522m-m242-jr9p
Published
2024-11-13T16:15:19Z
Modified
2024-11-19T00:57:17.631650Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.

References

Affected packages

Git / github.com/xwikisas/macro-pdfviewer

Affected ranges

Type
GIT
Repo
https://github.com/xwikisas/macro-pdfviewer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8b5e3f4e44d9d0fe2447358fe4d1b706b7101633

Affected versions

macro-pdfviewer-1.*

macro-pdfviewer-1.7
macro-pdfviewer-1.8
macro-pdfviewer-1.8.1
macro-pdfviewer-1.8.2
macro-pdfviewer-1.8.3
macro-pdfviewer-1.9
macro-pdfviewer-1.9.1
macro-pdfviewer-1.9.2
macro-pdfviewer-1.9.3
macro-pdfviewer-1.9.4

macro-pdfviewer-2.*

macro-pdfviewer-2.0
macro-pdfviewer-2.0.1
macro-pdfviewer-2.0.2
macro-pdfviewer-2.0.3
macro-pdfviewer-2.1
macro-pdfviewer-2.1.1
macro-pdfviewer-2.2
macro-pdfviewer-2.2-RC-1
macro-pdfviewer-2.2.1
macro-pdfviewer-2.3
macro-pdfviewer-2.3.1
macro-pdfviewer-2.3.2
macro-pdfviewer-2.3.3
macro-pdfviewer-2.4
macro-pdfviewer-2.5
macro-pdfviewer-2.5.1
macro-pdfviewer-2.5.2
macro-pdfviewer-2.5.3
macro-pdfviewer-2.5.4
macro-pdfviewer-2.5.5

xwiki-macro-pdfviewer-1.*

xwiki-macro-pdfviewer-1.5
xwiki-macro-pdfviewer-1.6
xwiki-macro-pdfviewer-1.6.1
xwiki-macro-pdfviewer-1.6.2

xwiki-macro-pdfviewer-parent-1.*

xwiki-macro-pdfviewer-parent-1.0
xwiki-macro-pdfviewer-parent-1.1
xwiki-macro-pdfviewer-parent-1.2
xwiki-macro-pdfviewer-parent-1.3
xwiki-macro-pdfviewer-parent-1.4
xwiki-macro-pdfviewer-parent-1.4.1