CVE-2024-30263

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.

• CWE-200

• https://github.com/xwikisas/macro-pdfviewer/issues/49
• https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f
• https://github.com/xwikisas/macro-pdfviewer/issues/49
• https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30258FastDDS is a C++ implementation of the DDS (Data Distributio…7.5
• CVE-2024-30259FastDDS is a C++ implementation of the DDS (Data Distributio…7.5
• CVE-2024-3026The WordPress Button Plugin MaxButtons WordPress plugin befo…5.4
• CVE-2024-30260Undici is an HTTP/1.1 client, written from scratch for Node.…4.3
• CVE-2024-30261Undici is an HTTP/1.1 client, written from scratch for Node.…3.5
• CVE-2024-30262Contao is an open source content management system. Prior to…7.1
• CVE-2024-30264Typebot is an open-source chatbot builder. A reflected cross…9.3
• CVE-2024-30265Collabora Online is a collaborative online office suite base…7.5
• CVE-2024-30266wasmtime is a runtime for WebAssembly. The 19.0.0 release of…5.5
• CVE-2024-30268Cacti provides an operational monitoring and fault managemen…6.1
• CVE-2024-30269DataEase, an open source data visualization and analysis too…5.3
• CVE-2024-3027The Smart Slider 3 plugin for WordPress is vulnerable to una…6.4