CVE-2024-39344 Information disclosure in n/a
Attackers can access exposed configuration keys in the DocuSign Salesforce package to create valid admin sessions, leading to complete account compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39344?
CVE-2024-39344 is a high-severity vulnerability in n/a, published on 21 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromised. With the default settings when installed for all users, the object can be accessible and (via its fields) could disclose some keys. These disclosed components can be combined to create a valid session via the Docusign API. This will generally lead to a complete compromise of the Docusign account because the session is for an administrator service account and may have permission to re-authenticate as specific users with the same authorization flow.
Weakness: CWE-200
Which versions are affected by CVE-2024-39344?
How do I fix CVE-2024-39344?
No fix has been published for CVE-2024-39344 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-39344 being exploited?
There is no known exploitation of CVE-2024-39344 in the wild and no public exploit code.
Sources
Also known as GHSA-q9rp-4m44-qjc7.