{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-07T01:09:27.708","vulnerabilities":[{"cve":{"id":"CVE-2024-38523","sourceIdentifier":"security-advisories@github.com","published":"2024-06-27T20:15:22.003","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.\n"},{"lang":"es","value":"Hush Line es una línea de sugerencias anónimas como servicio, gratuita y de código abierto para organizaciones o individuos. El flujo de autenticación TOTP tiene múltiples problemas que debilitan su naturaleza única. Específicamente, la falta de 2FA para cambiar la configuración de seguridad permite a un atacante con primitivas CSRF o XSS cambiar dicha configuración sin interacción del usuario y sin que se requieran credenciales. Esta vulnerabilidad ha sido parcheada en la versión 0.10."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/scidsg/hushline/pull/376","source":"security-advisories@github.com"},{"url":"https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx","source":"security-advisories@github.com"},{"url":"https://github.com/scidsg/hushline/pull/376","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}