CVE-2024-38522 - CVE House
Back to Database
Status published Medium CVE-2024-38522

CSP bypass in Hush Line

Vulnerability Description

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-38522

Credits & Attribution

No credits recorded in the NVD database.

References

More from scidsg

View All →
CVE-2024-55888
Content Security Policy appears to be missing in software and production setup
High 7.1
CVE-2024-38523
Hush Line OTP issue
High 7.5
CVE-2024-38521
Persistent Cross-Site Scripting (XSS) in hushline inbox
High 8.8

Affected Vendor

Affected Software

hushline
Vulnerable Versions:
< 0.1.0

Timeline

Official Publish: June 28th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-183

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.