« Volver al listado

CVE-2024-52271

Estado: AplazadaAlta (8.2)—

User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.

This issue affects Documenso: through 1.8.0, >1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI misrepresentation requiere interacción del usuario (UI:P) con documento preparado → T1203. Impacto: manipulación de datos mostrados (capas no aplanadas en impresión) → T1565.001; potencial para phishing con adjunto falsificado → T1566.002.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingUser Account ManagementRestrict Web-Based ContentRestrict File and Directory PermissionsRemote Data StorageEncrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Documenso — DocumensoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52271",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52271",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-05T14:14:26.736144Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "RED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "affectedData": [
        {
          "repo": "https://github.com/documenso/documenso",
          "vendor": "Documenso",
          "product": "Documenso",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "git",
              "lessThanOrEqual": "1.8.0"
            },
            {
              "status": "affected",
              "version": ">1.8.0",
              "versionType": "git"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Documenso",
          "product": "Documenso SaaS (Hosted)",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "date",
              "lessThanOrEqual": "2024-12-05"
            },
            {
              "status": "affected",
              "version": "2024-12-05",
              "versionType": "date"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:documenso:documenso:*:*:*:*:*:*:*:*"
          ],
          "vendor": "documenso",
          "product": "documenso",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "git",
              "lessThanOrEqual": "1.8.0"
            },
            {
              "status": "affected",
              "version": "1.8.0*"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:documenso:documenso:*:*:*:*:saas:*:*:*"
          ],
          "vendor": "documenso",
          "product": "documenso",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2024-12-05"
            },
            {
              "status": "affected",
              "version": "2024-12-05"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-12-05T14:15:21.417",
  "references": [
    {
      "url": "https://github.com/documenso/documenso",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://github.com/documenso/documenso/issues/1512",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://www.documenso.com/",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://www.vulsec.org/advisories",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.\n\n\nThis issue affects Documenso: through 1.8.0, >1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de tergiversación de información crítica en la interfaz de usuario (IU) de Documenso permite la suplantación de contenido. La versión mostrada no muestra la versión aplanada de capas una vez descargada. Si se imprime (por ejemplo, a través de Google Chrome -> Examinar la vista previa de impresión): solo se mostrará la vulnerabilidad, no se aplanarán todas las capas. Este problema afecta a Documenso: hasta 1.8.0, >1.8.0 y Documenso SaaS (alojado) a partir del 5 de diciembre de 2024."
    }
  ],
  "lastModified": "2026-06-17T08:06:54.807",
  "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
}