Skip to content
OpenAdvisories

Product · xwikisas

macro-pdfviewer

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2024-52298

    macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachm…

    xwikisas macro-pdfviewer
  • High 7.5
    CVE-2024-52299

    The PDF viewer macro allows accessing any attachment without access right checks

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the dige…

    xwikisas macro-pdfviewer
  • High 7.7
    CVE-2024-30263

    The PDF Viewer macro can be used to view PDF attachments with restricted access

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights ca…

    xwikisas macro-pdfviewer