CVE-2024-52269

User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This issue affects DocuSign: through 2024-12-04.

CVSS v4.0

8.2 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.28% chance of exploitation in the next 30 days, 20th percentile

Published

2024-12-04

Updated

2025-01-06

Proof-of-concept exploits (1)

• https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f

References

• CVE Record
• NVD entry

Related

• CVE-2024-5217
• CVE-2024-52270
• CVE-2024-52046
• CVE-2024-52272
• CVE-2024-52035
• CVE-2024-52273