Anonymous Tip Line Vulnerable to Stored XSS Attack
CVE-2024-38521

6.1MEDIUM

Key Information:

Vendor

Scidsg

Status
Hushline
Vendor
CVE Published:
28 June 2024

What is CVE-2024-38521?

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0.

Affected Version(s)

hushline < 0.1.0

References

https://github.com/scidsg/hushline/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.