PT-2024-28050 · Hush Line · Hush Line

Lsd-Cat · Published 2024-06-28 · Updated 2024-09-17 · CVE-2024-38522

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hush Line versions prior to 0.1.0

Description The Content Security Policy (CSP) applied on the tips.hushline.app website and bundled by default in the Hush Line repository is trivial to bypass. Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals.

Recommendations For versions prior to 0.1.0, update to version 0.1.0 to resolve the issue. As a temporary workaround, consider reviewing and reinforcing the CSP policy to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-697

CWE-183

Related Identifiers

CVE-2024-38522

GHSA-R85C-95X7-4H7Q

Affected Products

Hush Line

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38522.json · Exploit
• 🔥 https://github.com/scidsg/hushline/security/advisories/GHSA-r85c-95x7-4h7q · Exploit
• https://github.com/scidsg/hushline/commit/2bbeae78a24ca2cd893f32a1812f5f6634cb21b6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-38522 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38522 · Vendor Advisory
• https://t.me/cvenotify/94972 · Telegram Post
• https://t.me/cvenotify/84813 · Telegram Post