Vulnerability in Dropbox(hellosign) Dropbox Sign
CVE-2024-52270
User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04.
Published · last modified .
EPSS exploit prediction
EPSS: 0.002 (8.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Dropbox(hellosign) Dropbox Sign — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (vdb-entry)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (exploit)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (exploit)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (exploit)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (product)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (product)
Frequently asked questions
- What is CVE-2024-52270?
- CVE-2024-52270 is a vulnerability in Dropbox(hellosign) Dropbox Sign, classified under User Interface (UI) Misrepresentation of Critical Information. Published 2024-12-05.
- Is CVE-2024-52270 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.