← Retour aux CVEs

CVE-2024-38523

HIGH

7.5

Description

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteHIGH

Privileges requisLOW

Interaction utilisateurNONE

Publie6/27/2024

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-287

References

https://github.com/scidsg/hushline/pull/376(security-advisories@github.com)

https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx(security-advisories@github.com)

https://github.com/scidsg/hushline/pull/376(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.