CVE-2024-52300 — macro-pdfviewer has a XSS through the width parameter

CVE-2024-52300

macro-pdfviewer has a XSS through the width parameter PUBLISHED

Description (CNA)

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.

Affected (CNA)

Vendor / product	Versions
xwikisas / macro-pdfviewer	affected < 2.5.6

CWE

CWE-80

References

https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6g

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.