CVE-2024-52300

The width parameter of the PDF Viewer macro is not properly escaped before display in the browser, which allows embedding of arbitrary JavaScript code (XSS). Any user with permissions to edit the page can inject a malicious payload into the value of this parameter. The attack requires user interaction — specifically a visit by an administrator to the prepared page, which classifies it as stored XSS with privilege escalation. Due to the scope of the script's operation in the context of an administrator's session, it is possible to take control of the entire XWiki installation.

An attacker can compromise the confidentiality, integrity, and availability of the entire XWiki installation by performing arbitrary actions in the context of an administrator's session who visits the page with malicious code.

The macro-pdfviewer macro should be updated to version 2.5.6 or newer, in which the vulnerability has been fixed.

The macro-pdfviewer macro (PDF Viewer Macro for XWiki) — versions prior to 2.5.6.