CVE-2024-55888 - CVE House
Back to Database
Status published High CVE-2024-55888

Content Security Policy appears to be missing in software and production setup

Vulnerability Description

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scripting filters. Version 0.3.5 fixed the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-55888

Credits & Attribution

No credits recorded in the NVD database.

References

More from scidsg

View All →
CVE-2024-38523
Hush Line OTP issue
High 7.5
CVE-2024-38522
CSP bypass in Hush Line
Medium 6.3
CVE-2024-38521
Persistent Cross-Site Scripting (XSS) in hushline inbox
High 8.8

Affected Vendor

Affected Software

hushline
Vulnerable Versions:
>= 0.1.0, < 0.3.5

Timeline

Official Publish: December 12th, 2024
Last Modified: December 13th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weaknesses (CWE)

CWE-1021

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.