« Volver al listado

CVE-2024-52270

Estado: AplazadaAlta (8.2)—

User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:P (interacción del usuario) + acceso local dictaminan T1203. Impactos: CWE-451 (misrepresentación UI) permite spoofing de contenido (T1565.001); el ataque afecta también a visualización de capas en impresión, facilitando engaño sobre información crítica (T1040 contextual).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Encrypt Sensitive InformationUser Account ManagementRestrict File and Directory PermissionsRemote Data StorageNetwork SegmentationMulti-factor Authentication

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Dropbox — SignAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52270",
  "cveTags": [
    {
      "tags": [
        "exclusively-hosted-service"
      ],
      "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
        "ssvcData": {
          "id": "CVE-2024-52270",
          "role": "Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52270",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-05T14:49:19.543227Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.2,
          "Automatable": "YES",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "RED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "affectedData": [
        {
          "vendor": "DropBox(HelloSign)",
          "product": "DropBox Sign",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "git",
              "lessThanOrEqual": "2024-12-04"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-12-05T11:15:06.837",
  "references": [
    {
      "url": "https://app.hellosign.com/",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://sign.dropbox.com/",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://www.loom.com/share/48f63594e14c49e19840ad9cb7d60453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    },
    {
      "url": "https://www.vulsec.org/advisories",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.\nDisplayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DropBox Sign(HelloSign): through 2024-12-04."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de representación errónea de información crítica en la interfaz de usuario (IU) en DropBox Sign (HelloSign) permite la suplantación de contenido. La versión mostrada no muestra la versión aplanada de la capa, una vez descargada. Si se imprime (por ejemplo, a través de Google Chrome -> Examinar la vista previa de impresión): solo se mostrará la vulnerabilidad, no se aplanarán todas las capas. Este problema afecta a DropBox Sign (HelloSign): hasta el 4 de diciembre de 2024."
    }
  ],
  "lastModified": "2026-06-17T08:06:54.683",
  "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe"
}