What’s Vulnerable › Vulnerabilities

CVE-2024-38523: Hush Line OTP issue

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-27 · updated 2026-06-17
• Weakness: CWE-287

Description

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.

Affected products

• scidsg Hushline: before 0.1.0 — fixed in 0.1.0

How to fix

Upgrade to a fixed version: scidsg Hushline 0.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/scidsg/hushline/pull/376
• https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx
• https://github.com/scidsg/hushline/pull/376
• https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx

Get alerted when CVE-2024-38523 or the next vulnerability affects your stack