CVE-2024-52298

CVE-2024-52298 is a high-severity vulnerability affecting the macro-pdfviewer in XWiki, specifically the PDF Viewer Macro. This flaw allows an unauthenticated attacker to view any attached PDF file by leveraging the "Delegate my view right" feature, provided they can view a page whose last author has access to the attachment. The attacker can obtain the necessary attachment reference from the Page Index's Attachments tab, even for protected files, by inspecting HTTP requests. With a CVSS score of 7.5 (High), the vulnerability has a network attack vector and low attack complexity, potentially leading to unauthorized information disclosure (confidentiality impact). There is currently no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. A fix is available in version 2.5.6 of the affected product.