High severity7.7NVD Advisory· Published Apr 4, 2024· Updated Apr 15, 2026

CVE-2024-30263

Description

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the `file` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cryptpad/Macro Pdfviewerreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.5.1

Patches

Vulnerability mechanics

References

github.com/xwikisas/macro-pdfviewer/issues/49nvd
github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29fnvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000