CVE-2024-52271 - PDF Document Spoofing in Documenso

Back Back to CVE browser

HIGH

PDF Document Spoofing in Documenso

Published Dec 5, 2024

8.2

HIGH

CVSS 4.0

EPSS 0.21%

Description

User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.

This issue affects Documenso: through 1.8.0, >1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05.

Affected products

Vendor Documenso Product Documenso Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=1.8.0
- Version
  >1.8.0
  Status
  affected
  Constraints
  -
Vendor Documenso Product Documenso SaaS (Hosted) Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=2024-12-05
- Version
  2024-12-05
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Documenso

affected

Version	Status	Constraints
0	affected	<=1.8.0
>1.8.0	affected	-

Documenso

Documenso SaaS (Hosted)

affected

Version	Status	Constraints
0	affected	<=2024-12-05
2024-12-05	affected	-

Vendor Documenso Product Documenso Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=1.8.0
- Version
  0
  Status
  affected
  Constraints
  <=2024-12-05
- Version
  1.8.0*
  Status
  affected
  Constraints
  -
- Version
  2024-12-05
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Documenso

n/a

Version	Status	Constraints
0	affected	<=1.8.0
0	affected	<=2024-12-05
1.8.0*	affected	-
2024-12-05	affected	-

Remediation

Vendor solution

* If other party initiated e-signing - Download the PDF file for a security professionals/educated persons inspection * If possible - Download the PDF file and perform full flattening (of the entire document, not just form fields)

Weaknesses (1)

CWE-451

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46112
Advisory
https://github.com/documenso/documenso
product
https://github.com/documenso/documenso/issues/1512
issue-tracking
https://www.documenso.com/
product
https://www.vulsec.org/advisories
vdb-entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46112		Advisory
https://github.com/documenso/documenso		product
https://github.com/documenso/documenso/issues/1512		issue-tracking
https://www.documenso.com/		product
https://www.vulsec.org/advisories		vdb-entry