« Volver al listado

CVE-2024-38523

Estado: AplazadaAlta (7.5)—

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Hushline — Hush LineAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38523",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38523",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-28T20:16:48.703201Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "scidsg",
          "product": "hushline",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.1.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:scidsg:hushline:*:*:*:*:*:*:*:*"
          ],
          "vendor": "scidsg",
          "product": "hushline",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.1.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-27T20:15:22.003",
  "references": [
    {
      "url": "https://github.com/scidsg/hushline/pull/376",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/scidsg/hushline/pull/376",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.\n"
    },
    {
      "lang": "es",
      "value": "Hush Line es una línea de sugerencias anónimas como servicio, gratuita y de código abierto para organizaciones o individuos. El flujo de autenticación TOTP tiene múltiples problemas que debilitan su naturaleza única. Específicamente, la falta de 2FA para cambiar la configuración de seguridad permite a un atacante con primitivas CSRF o XSS cambiar dicha configuración sin interacción del usuario y sin que se requieran credenciales. Esta vulnerabilidad ha sido parcheada en la versión 0.10."
    }
  ],
  "lastModified": "2026-06-17T07:40:28.077",
  "sourceIdentifier": "security-advisories@github.com"
}