{"id":"CVE-2024-52276","aliases":["EUVD-2024-46117","GHSA-2rgr-w2hf-5v57"],"status":"published","title":"PDF Document Spoofing in DocuSign","description":"User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing.\n1. Displayed version does not show the layer flattened version, which is provided when the \"Print\" option is used.\n2. Displayed version does not show the layer flattened version, which is provided when the combined download option is used.\n3. Displayed version does not show the layer flattened version, which is also the provided version when downloading the result in the uncombined option.\nOnce download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DocuSign: through 2024-12-04.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/U:Red","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00352,"percentile":0.29026,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-451"],"published":"2024-12-04T10:13:06Z","modified":"2026-06-17T08:06:55Z","products":[{"vendor":"docusign","product":"docusign"}],"references":[{"url":"https://www.vulsec.org/advisories","tags":["vdb-entry"]},{"url":"https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f","tags":["exploit"]},{"url":"https://new.space/s/3SG3wQxTSg7lq-vLzUjy-Q#mmrg4t0wMThwTqs9nogVHdLAjMFlkgFnKHn_Q8u9cCs","tags":["exploit"]},{"url":"https://drive.proton.me/urls/QD7Z493XX4#Yn3eKAjuZA5m","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52276"},{"url":"https://github.com/advisories/GHSA-2rgr-w2hf-5v57"}],"sources":{"cve":[{"id":"CVE-2024-52276","title":"PDF Document Spoofing in DocuSign","description":"User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing.\n1. Displayed version does not show the layer flattened version, which is provided when the \"Print\" option is used.\n2. Displayed version does not show the layer flattened version, which is provided when the combined download option is used.\n3. Displayed version does not show the layer flattened version, which is also the provided version when downloading the result in the uncombined option.\nOnce download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DocuSign: through 2024-12-04.","status":"published","published":"2024-12-04T10:13:06.765Z","modified":"2025-01-06T17:41:35.365Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/U:Red","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-451"],"updated_at":"2026-11-02T14:34:03.333404Z"}],"euvd":[{"id":"EUVD-2024-46117","description":"User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing.\n1. Displayed version does not show the layer flattened version, which is provided when the \"Print\" option is used.\n2. Displayed version does not show the layer flattened version, which is provided when the combined download option is used.\n3. Displayed version does not show the layer flattened version, which is also the provided version when downloading the result in the uncombined option.\nOnce download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DocuSign: through 2024-12-04.","status":"published","published":"2024-12-04T10:13:06Z","modified":"2025-01-06T17:41:35Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/U:Red","level":"high"}],"updated_at":"2026-11-03T00:04:25.578405Z"}],"ghsa":[{"id":"GHSA-2rgr-w2hf-5v57","title":"** INITIAL LIMITED RELEASE **\n\nUser Interface (UI) Misrepresentation of Critical Information...","description":"** INITIAL LIMITED RELEASE **\n\nUser Interface (UI) Misrepresentation of Critical Information vulnerability in [WITHHELD] allows Content Spoofing.This issue affects [WITHHELD]: through 2024-12-04.","status":"published","published":"2024-12-04T12:31:45Z","modified":"2025-01-06T18:31:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red","level":"high"}],"cwes":["CWE-451"],"updated_at":"2026-11-02T14:59:21.962449Z"}],"nvd":[{"id":"CVE-2024-52276","description":"User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing.\n1. Displayed version does not show the layer flattened version, which is provided when the \"Print\" option is used.\n2. Displayed version does not show the layer flattened version, which is provided when the combined download option is used.\n3. Displayed version does not show the layer flattened version, which is also the provided version when downloading the result in the uncombined option.\nOnce download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DocuSign: through 2024-12-04.","status":"published","published":"2024-12-04T11:30:50.947Z","modified":"2026-06-17T08:06:55.433Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-451"],"updated_at":"2026-11-02T14:10:38.973941Z"}]}}