Description (CNA)
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenSignLabs / OpenSign | affected 0 through 2.37.0 |
CWE
CWE-345
References
ADP enrichment
No English description supplied.
No references supplied.