CVE-2024-42489 json
Pro Macros Remote Code Execution via Viewpdf and similar macros
published 2024-08-12 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-39643
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- xwikisas xwiki-pro-macros
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/xwikisas/xwiki-pro-macros/commit/199553c84901999481a20614f093af2d57970eba
patch
-
github.com
/xwikisas/xwiki-pro-macros/security/advisories/GHSA-cfq3-q227-7j65
vendor-advisory
-
github.com
/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Viewpdf.xml#L265
broken-link
Sources
- CVE List CVE-2024-42489
- NVD CVE-2024-42489
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.