CVE-2024-52270 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04.

Reserved 2024-11-06 | Published 2024-12-05 | Updated 2024-12-05 | Assigner VULSec

HIGH: 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/AU:Y/U:Red

Problem types

CWE-451 User Interface (UI) Misrepresentation of Critical Information

Product status

Default status

affected

Any version

affected

Credits

Erez Kalman finder

References

www.vulsec.org/advisories vdb-entry

www.loom.com/...453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038 exploit

new.space/s/ZuHoujvkjdzfY7Uihah7Yg exploit

drive.proton.me/urls/Z6DHXNRZQC exploit

sign.dropbox.com/ product

app.hellosign.com/ product

cve.org (CVE-2024-52270)

nvd.nist.gov (CVE-2024-52270)

Download JSON

https://cve.threatint.eu/CVE/CVE-2024-52270

Support options

Helpdesk Chat, Email, Knowledgebase