PT-2024-35146 · Docusign · Docusign

Erez Kalman · Published 2024-12-04 · Updated 2025-01-06 · CVE-2024-52276

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DocuSign versions through 2024-12-04

Description The issue is related to a User Interface (UI) Misrepresentation of Critical Information vulnerability, which allows Content Spoofing. This means that the displayed version of a document does not accurately represent the actual content, specifically when using the "Print" option, combined download option, or uncombined download option. The vulnerability can be observed when printing the document, for example, via Google Chrome's print preview, where only the vulnerable content is rendered, and not all layers are flattened.

Recommendations For DocuSign versions through 2024-12-04, update to a version released after 2024-12-04 to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2024-52276

Affected Products

Docusign

References · 11

• 🔥 https://new.space/s/3SG3wQxTSg7lq-vLzUjy-Q#mmrg4t0wMThwTqs9nogVHdLAjMFlkgFnKHn_Q8u9cCs · Exploit
• 🔥 https://loom.com/share/65ce5423d2a04e0bbd2688a178d5427f · Exploit
• 🔥 https://drive.proton.me/urls/QD7Z493XX4#Yn3eKAjuZA5m · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52276 · Security Note
• https://t.me/cvenotify/103002 · Telegram Post
• https://twitter.com/oktsec/status/1864680697522229693 · Twitter Post
• https://t.me/cvedetector/11972 · Telegram Post
• https://vulsec.org/advisories · Note
• https://t.me/cvenotify/103090 · Telegram Post
• https://twitter.com/CVEnew/status/1864258366794580128 · Twitter Post
• https://t.me/cvenotify/103091 · Telegram Post