CVE-2024-38522
EUVD-2024-3739128.06.2024, 17:15
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| hushline | hush_line | 𝑥 < 0.1.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-183 - Permissive List of Allowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
- CWE-697 - Incorrect ComparisonThe software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
References