Vulnerability · Published Jun 27, 2024 · Assigned by GitHub_M

CVE-2024-38523Hush Line OTP issue

High 7.5

In plain English

A high-severity improper authentication in hushline from scidsg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.

Affected products (as reported)

Vendor	Product	Versions
scidsg	hushline	< 0.1.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx x_refsource_CONFIRM
https://github.com/scidsg/hushline/pull/376 x_refsource_MISC