TI-2024-25758 Aliases CVE-2024-38523

Hush Line OTP issue

LOW 35CWE-287Published 2024-06-27 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00515 44th percentileScored 2026-11-07

Fix Fixed hushline (scidsg): 0.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
scidsg	hushline	before 0.1.0	0.1.0	Patch available	CNA

hushline Vendorscidsg Affected before 0.1.0 Fixed in 0.1.0 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:scidsg:hushline::::::::	—	—	scidsg

cpe:2.3:a:scidsg:hushline:*:*:*:*:*:*:*:* Versions — — ·scidsg

Remediation

Fix · CNA hushline (scidsg) Fixed in 0.1.0

Timeline

2026-10-02 Threatist record created from CVE-2024-38523

References

Other 2

TI-2024-36954 Content Security Policy appears to be missing in software and production setup CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences