CVE-2024-52271

PDF Document Spoofing in Documenso

CVSS 8.2 HIGHEPSS 0.2%CWE-451

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.2EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

05 Dec 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects Documenso: through 1.8.0, >1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/U:Red

Affected products

Documenso · Documenso Documenso · Documenso SaaS (Hosted)

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/documenso/documenso https://github.com/documenso/documenso/issues/1512 https://www.documenso.com/https://www.vulsec.org/advisories