CVE-2024-38522

Summary

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the tips.hushline.app website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.

Affected Software

VendorProductVersion RangeStatus
scidsghushline< 0.1.0affected

Weaknesses

  • CWE-183: CWE-183: Permissive List of Allowed Inputs

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References