CVE-2024-52270CWE-451

PDF Document Spoofing in DropBox Sign(HelloSign)

High · published December 5, 2024

CVSS v4.0
8.2
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.

Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.

This issue affects DropBox Sign(HelloSign): through 2024-12-04.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/AU:Y/U:Red
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2024-12-05T10:55Z
EPSS history
Timeline
  • 05 DEC 10:55Z
    PDF Document Spoofing in DropBox Sign(HelloSign)
    cvelistv5