Home

Description

User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04.

PUBLISHED Reserved 2024-11-06 | Published 2024-12-05 | Updated 2024-12-05 | Assigner VULSec




HIGH: 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/AU:Y/U:Red

Problem types

CWE-451 User Interface (UI) Misrepresentation of Critical Information

Product status

Default status
affected

Any version
affected

Credits

Erez Kalman finder

References

www.vulsec.org/advisories vdb-entry

www.loom.com/...453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038 exploit

new.space/s/ZuHoujvkjdzfY7Uihah7Yg exploit

drive.proton.me/urls/Z6DHXNRZQC exploit

sign.dropbox.com/ product

app.hellosign.com/ product

cve.org (CVE-2024-52270)

nvd.nist.gov (CVE-2024-52270)

Download JSON