CVE-2024-52269

User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This issue affects DocuSign: through 2024-12-04.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f
https://www.vulsec.org/advisories

Configurations

No configuration.

History

No history.

Information

Published : 2024-12-04 12:15

Updated : 2025-01-06 18:15

NVD link : CVE-2024-52269

Mitre link : CVE-2024-52269

CVE.ORG link : CVE-2024-52269

JSON object : View

Products Affected

No product.

CWE

CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2024-52269", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-12-04T12:15:19.500", "references": [{"url": "https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}, {"url": "https://www.vulsec.org/advisories", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing.\nThe SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user.\nFor reference see:\u00a0CVE-2024-52276\nThis issue affects DocuSign: through 2024-12-04."}, {"lang": "es", "value": "** LANZAMIENTO LIMITADO INICIAL ** La vulnerabilidad de tergiversaci\u00f3n de informaci\u00f3n cr\u00edtica en la interfaz de usuario (IU) en [WITHHELD] permite la suplantaci\u00f3n de contenido. El asistente de inteligencia artificial de SaaS ignora el contenido oculto que se muestra despu\u00e9s de firmar, lo que enga\u00f1a al usuario. Este problema afecta a [WITHHELD]: hasta el 4 de diciembre de 2024."}], "lastModified": "2025-01-06T18:15:20.720", "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"}