CVE-2024-52270
PDF Document Spoofing in DropBox Sign(HelloSign)
HIGH 8.2EPSS 0.2%
User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.This issue affects DropBox Sign(HelloSign): through 2024-12-04.
- Affected
- DropBox(HelloSign) · DropBox Sign
- CVSS v4.0 CNA
- 8.2 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red - EPSS
- 0.19% chance of exploitation in the next 30 days, 8th percentile
- Published
- 2024-12-05
- Updated
- 2026-09-21
Proof-of-concept exploits (3)
- https://www.loom.com/share/48f63594e14c49e19840ad9cb7d60453?sid=816c6afa-0b67-4b0b-98ff-d…
- https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs
- https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj