« Volver al listado

CVE-2024-39344

Estado: AplazadaAlta (8.1)—

An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromised. With the default settings when installed for all users, the object can be accessible and (via its fields) could disclose some keys. These disclosed components can be combined to create a valid session via the Docusign API. This will generally lead to a complete compromise of the Docusign account because the session is for an administrator service account and may have permission to re-authenticate as specific users with the same authorization flow.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Docusign — API PackageAISalesforce — SalesforceAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39344",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39344",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-26T15:11:43.415727Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:salesforce:docusign_api_package_for_salesforce:8.142.14:*:*:*:*:*:*:*"
          ],
          "vendor": "salesforce",
          "product": "docusign_api_package_for_salesforce",
          "versions": [
            {
              "status": "affected",
              "version": "8.142.14"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-21T16:15:08.013",
  "references": [
    {
      "url": "https://deneyed.com/blog/conga/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://login.salesforce.com/packaging/installPackage.apexp?p0=04t6S000000YUDxQAO",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromised. With the default settings when installed for all users, the object can be accessible and (via its fields) could disclose some keys. These disclosed components can be combined to create a valid session via the Docusign API. This will generally lead to a complete compromise of the Docusign account because the session is for an administrator service account and may have permission to re-authenticate as specific users with the same authorization flow."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en el paquete API de Docusign 8.142.14 para Salesforce. El objeto Apttus_DocuApi__DocusignAuthentication__mdt se instala a través del mercado desde este paquete y almacena cierta información de configuración de una manera que podría verse comprometida. Con la configuración predeterminada cuando se instala para todos los usuarios, se puede acceder al objeto y (a través de sus campos) podría revelar algunas claves. Estos componentes revelados se pueden combinar para crear una sesión válida a través de la API de Docusign. Por lo general, esto comprometerá completamente la cuenta de Docusign porque la sesión es para una cuenta de servicio de administrador y puede tener permiso para volver a autenticarse como usuarios específicos con el mismo flujo de autorización."
    }
  ],
  "lastModified": "2026-06-17T07:41:45.707",
  "sourceIdentifier": "cve@mitre.org"
}