CVE-2024-52299 The PDF viewer macro allows accessing any attachment without access right checks
Attackers with view rights can access any wiki attachment without proper authorization checks due to flawed key computation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52299?
CVE-2024-52299 is a high-severity missing authorization vulnerability in xwikisas macro-pdfviewer, published on 13 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.
Weakness: CWE-340
Which versions are affected by CVE-2024-52299?
It affects 1 product.
Products include Xwiki Pdf Viewer Macro.
How do I fix CVE-2024-52299?
No fix has been published for CVE-2024-52299 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-52299 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52299 exists.
Other vulnerabilities in xwikisas macro-pdfviewer
Sources
Also known as GHSA-522m-m242-jr9p.