CVE-2024-38523

{"id": "CVE-2024-38523", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2024-06-27T20:15:22.003", "references": [{"url": "https://github.com/scidsg/hushline/pull/376", "source": "security-advisories@github.com"}, {"url": "https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx", "source": "security-advisories@github.com"}, {"url": "https://github.com/scidsg/hushline/pull/376", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.\n"}, {"lang": "es", "value": "Hush Line es una l\u00ednea de sugerencias an\u00f3nimas como servicio, gratuita y de c\u00f3digo abierto para organizaciones o individuos. El flujo de autenticaci\u00f3n TOTP tiene m\u00faltiples problemas que debilitan su naturaleza \u00fanica. Espec\u00edficamente, la falta de 2FA para cambiar la configuraci\u00f3n de seguridad permite a un atacante con primitivas CSRF o XSS cambiar dicha configuraci\u00f3n sin interacci\u00f3n del usuario y sin que se requieran credenciales. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 0.10."}], "lastModified": "2024-11-21T09:26:11.020", "sourceIdentifier": "security-advisories@github.com"}