CVE-2024-52300
macro-pdfviewer has a XSS through the width parameter
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
macro-pdfviewer has a XSS through the width parameter
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
Reserved 2024-11-06 | Published 2024-11-13 | Updated 2024-11-13 | Assigner GitHub_Mgithub.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6g
Support options
