Vulnerability in Dropbox(hellosign) Dropbox Sign
CVE-2024-52270
User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04.
EPSS: 0.002 (9.1th percentile) — read the EPSS interpretation.
Affected products
- Dropbox(hellosign) Dropbox Sign — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (vdb-entry)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (exploit)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (exploit)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (exploit)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (product)
- 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe (product)
Frequently asked questions
- What is CVE-2024-52270?
- CVE-2024-52270 is a vulnerability in Dropbox(hellosign) Dropbox Sign, classified under User Interface (UI) Misrepresentation of Critical Information. Published 2024-12-05.
- Is CVE-2024-52270 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.