CVE-2024-52300

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-52300

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52300.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-52300

Aliases

GHSA-84wx-6vfp-5m6g

Published

2024-11-13T15:24:59Z

Modified

2026-08-12T03:51:46Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

macro-pdfviewer has a XSS through the width parameter

Details

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52300.json"
}

References

Affected packages

Git / github.com/xwikisas/macro-pdfviewer

Affected ranges

Type

GIT

Repo

https://github.com/xwikisas/macro-pdfviewer

Events

Introduced

Fixed

8b5e3f4e44d9d0fe2447358fe4d1b706b7101633

Database specific

Show details

{
    "cpe": "cpe:2.3:a:xwiki:pdf_viewer_macro:*:*:*:*:pro:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

macro-pdfviewer-1.*

macro-pdfviewer-1.7

macro-pdfviewer-1.8

macro-pdfviewer-1.8.1

macro-pdfviewer-1.8.2

macro-pdfviewer-1.8.3

macro-pdfviewer-1.9

macro-pdfviewer-1.9.1

macro-pdfviewer-1.9.2

macro-pdfviewer-1.9.3

macro-pdfviewer-1.9.4

macro-pdfviewer-2.*

macro-pdfviewer-2.0

macro-pdfviewer-2.0.1

macro-pdfviewer-2.0.2

macro-pdfviewer-2.0.3

macro-pdfviewer-2.1

macro-pdfviewer-2.1.1

macro-pdfviewer-2.2

macro-pdfviewer-2.2-RC-1

macro-pdfviewer-2.2.1

macro-pdfviewer-2.3

macro-pdfviewer-2.3.1

macro-pdfviewer-2.3.2

macro-pdfviewer-2.3.3

macro-pdfviewer-2.4

macro-pdfviewer-2.5

macro-pdfviewer-2.5.1

macro-pdfviewer-2.5.2

macro-pdfviewer-2.5.3

macro-pdfviewer-2.5.4

macro-pdfviewer-2.5.5

xwiki-macro-pdfviewer-1.*

xwiki-macro-pdfviewer-1.5

xwiki-macro-pdfviewer-1.6

xwiki-macro-pdfviewer-1.6.1

xwiki-macro-pdfviewer-1.6.2

xwiki-macro-pdfviewer-parent-1.*

xwiki-macro-pdfviewer-parent-1.0

xwiki-macro-pdfviewer-parent-1.1

xwiki-macro-pdfviewer-parent-1.2

xwiki-macro-pdfviewer-parent-1.3

xwiki-macro-pdfviewer-parent-1.4

xwiki-macro-pdfviewer-parent-1.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52300.json"