CVE-2024-38523

Published: Jun 27, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://github.com/scidsg/hushline/pull/376

Source: security-advisories@github.com

https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx

Source: security-advisories@github.com

https://github.com/scidsg/hushline/pull/376

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.