CVE-2024-52270

User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04.

CVSS

No CVSS.

References

Link	Resource
https://app.hellosign.com/
https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj
https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs
https://sign.dropbox.com/
https://www.loom.com/share/48f63594e14c49e19840ad9cb7d60453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038
https://www.vulsec.org/advisories

Configurations

No configuration.

History

05 Dec 2024, 13:15

Type	Values Removed	Values Added
References		() https://app.hellosign.com/ - () https://sign.dropbox.com/ -

05 Dec 2024, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-05 11:15

Updated : 2024-12-05 13:15

NVD link : CVE-2024-52270

Mitre link : CVE-2024-52270

CVE.ORG link : CVE-2024-52270

JSON object : View

Products Affected

No product.

CWE

CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2024-52270", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.2, "automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "HIGH", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-12-05T11:15:06.837", "references": [{"url": "https://app.hellosign.com/", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}, {"url": "https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}, {"url": "https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}, {"url": "https://sign.dropbox.com/", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}, {"url": "https://www.loom.com/share/48f63594e14c49e19840ad9cb7d60453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}, {"url": "https://www.vulsec.org/advisories", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.\nDisplayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DropBox Sign(HelloSign): through 2024-12-04."}], "lastModified": "2024-12-05T13:15:09.133", "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}