PT-2024-28049 · Hush Line · Hush Line

Lsd-Cat · Published 2024-06-28 · Updated 2024-09-17 · CVE-2024-38521

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hush Line versions prior to 0.1.0

Description Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display.

Recommendations For versions prior to 0.1.0, update to version 0.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the Inbox feature until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-38521

GHSA-4V8C-R6H2-FHH3

Affected Products

Hush Line

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38521.json · Exploit
• 🔥 https://github.com/scidsg/hushline/security/advisories/GHSA-4v8c-r6h2-fhh3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-38521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38521 · Security Note
• https://t.me/cvenotify/94971 · Telegram Post
• https://t.me/cvenotify/84889 · Telegram Post
• https://t.me/cvenotify/84797 · Telegram Post