CVE-2024-30263 The PDF Viewer macro can be used to view PDF attachments with restricted access
Users with edit or view rights can bypass access restrictions to view protected PDF attachments via the PDF Viewer macro.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-30263?
CVE-2024-30263 is a high-severity missing authorization vulnerability in xwikisas macro-pdfviewer, published on 4 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.
Weakness: CWE-200
Which versions are affected by CVE-2024-30263?
How do I fix CVE-2024-30263?
No fix has been published for CVE-2024-30263 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-30263 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-30263 exists.
Sources
Also known as GHSA-93qq-2h34-g29f.