Vulnerability-Lookup

CVE-2024-31206 (GCVE-0-2024-31206)

Vulnerability from cvelistv5 – Published: 2024-04-04 22:10 – Updated: 2024-08-26 20:27

Title

Use of Unencrypted HTTP Request in dectalk-tts

Summary

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-05 17:16 UTC

CWE

CWE-300 - Channel Accessible by Non-Endpoint
CWE-319 - Cleartext Transmission of Sensitive Information
CWE-598 - Use of GET Request Method With Sensitive Query Strings

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/JstnMcBrd/dectalk-tts/security…	x_refsource_CONFIRM
https://github.com/JstnMcBrd/dectalk-tts/issues/3	x_refsource_MISC
https://github.com/JstnMcBrd/dectalk-tts/pull/4	x_refsource_MISC
https://github.com/JstnMcBrd/dectalk-tts/commit/3…	x_refsource_MISC
https://github.com/JstnMcBrd/dectalk-tts/blob/b3e…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
JstnMcBrd	dectalk-tts	Affected: = 1.0.0	guessed
jstnmcbrd	dectalk-tts	Affected: 1.0.0 cpe:2.3:a:jstnmcbrd:dectalk-tts:1.0.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:46:04.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/issues/3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/JstnMcBrd/dectalk-tts/issues/3"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/pull/4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/JstnMcBrd/dectalk-tts/pull/4"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:jstnmcbrd:dectalk-tts:1.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dectalk-tts",
            "vendor": "jstnmcbrd",
            "versions": [
              {
                "status": "affected",
                "version": "1.0.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31206",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T17:16:09.746920Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T20:27:25.984Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dectalk-tts",
          "vendor": "JstnMcBrd",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-300",
              "description": "CWE-300: Channel Accessible by Non-Endpoint",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-04T22:10:29.200Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w"
        },
        {
          "name": "https://github.com/JstnMcBrd/dectalk-tts/issues/3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JstnMcBrd/dectalk-tts/issues/3"
        },
        {
          "name": "https://github.com/JstnMcBrd/dectalk-tts/pull/4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JstnMcBrd/dectalk-tts/pull/4"
        },
        {
          "name": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105"
        },
        {
          "name": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18"
        }
      ],
      "source": {
        "advisory": "GHSA-6cf6-8hvr-r68w",
        "discovery": "UNKNOWN"
      },
      "title": "Use of Unencrypted HTTP Request in dectalk-tts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-31206",
    "datePublished": "2024-04-04T22:10:29.200Z",
    "dateReserved": "2024-03-29T14:16:31.900Z",
    "dateUpdated": "2024-08-26T20:27:25.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-31206",
      "date": "2026-09-16",
      "epss": "0.00332",
      "percentile": "0.26359"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.\"}, {\"lang\": \"es\", \"value\": \"dectalk-tts es un paquete de Nodo para interactuar con la API web aeiou Dectalk. En `dectalk-tts@1.0.0`, las solicitudes de red a la API de terceros se env\\u00edan a trav\\u00e9s de HTTP, que no est\\u00e1 cifrado. Los atacantes pueden interceptar y modificar f\\u00e1cilmente el tr\\u00e1fico no cifrado. Cualquiera que utilice el paquete podr\\u00eda ser v\\u00edctima de un ataque de intermediario (MITM). La solicitud de red se actualiz\\u00f3 a HTTPS en la versi\\u00f3n \\\"1.0.1\\\". No existen workarounds, pero algunas precauciones incluyen no enviar informaci\\u00f3n confidencial y verificar cuidadosamente la respuesta de la API antes de guardarla.\"}]",
      "id": "CVE-2024-31206",
      "lastModified": "2024-11-21T09:13:02.270",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 4.2}]}",
      "published": "2024-04-04T23:15:15.897",
      "references": "[{\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/issues/3\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/pull/4\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/issues/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/pull/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-300\"}, {\"lang\": \"en\", \"value\": \"CWE-319\"}, {\"lang\": \"en\", \"value\": \"CWE-598\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-31206\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-04-04T23:15:15.897\",\"lastModified\":\"2026-06-17T07:27:58.800\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.\"},{\"lang\":\"es\",\"value\":\"dectalk-tts es un paquete de Nodo para interactuar con la API web aeiou Dectalk. En `dectalk-tts@1.0.0`, las solicitudes de red a la API de terceros se env\u00edan a trav\u00e9s de HTTP, que no est\u00e1 cifrado. Los atacantes pueden interceptar y modificar f\u00e1cilmente el tr\u00e1fico no cifrado. Cualquiera que utilice el paquete podr\u00eda ser v\u00edctima de un ataque de intermediario (MITM). La solicitud de red se actualiz\u00f3 a HTTPS en la versi\u00f3n \\\"1.0.1\\\". No existen workarounds, pero algunas precauciones incluyen no enviar informaci\u00f3n confidencial y verificar cuidadosamente la respuesta de la API antes de guardarla.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"JstnMcBrd\",\"product\":\"dectalk-tts\",\"versions\":[{\"version\":\"= 1.0.0\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"jstnmcbrd\",\"product\":\"dectalk-tts\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:jstnmcbrd:dectalk-tts:1.0.0:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"1.0.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-05T17:16:09.746920Z\",\"id\":\"CVE-2024-31206\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-300\"},{\"lang\":\"en\",\"value\":\"CWE-319\"},{\"lang\":\"en\",\"value\":\"CWE-598\"}]}],\"references\":[{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/issues/3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/pull/4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/issues/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/pull/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T22:07:55+00:00",
      "cve": "CVE-2024-31206",
      "id": "CVE-2024-31206",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Use of Unencrypted HTTP Request in dectalk-tts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-31206.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/issues/3\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/issues/3\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/pull/4\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/pull/4\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:46:04.547Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-31206\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-05T17:16:09.746920Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:jstnmcbrd:dectalk-tts:1.0.0:*:*:*:*:*:*:*\"], \"vendor\": \"jstnmcbrd\", \"product\": \"dectalk-tts\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-26T20:27:21.159Z\"}}], \"cna\": {\"title\": \"Use of Unencrypted HTTP Request in dectalk-tts\", \"source\": {\"advisory\": \"GHSA-6cf6-8hvr-r68w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"JstnMcBrd\", \"product\": \"dectalk-tts\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 1.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/issues/3\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/issues/3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/pull/4\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/pull/4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\", \"name\": \"https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-300\", \"description\": \"CWE-300: Channel Accessible by Non-Endpoint\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-319\", \"description\": \"CWE-319: Cleartext Transmission of Sensitive Information\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-598\", \"description\": \"CWE-598: Use of GET Request Method With Sensitive Query Strings\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-04-04T22:10:29.200Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-31206\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-26T20:27:25.984Z\", \"dateReserved\": \"2024-03-29T14:16:31.900Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-04-04T22:10:29.200Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-31206

Vulnerability from fkie_nvd - Published: 2024-04-04 23:15 - Updated: 2026-06-17 07:27

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18
	security-advisories@github.com	https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105
	security-advisories@github.com	https://github.com/JstnMcBrd/dectalk-tts/issues/3
	security-advisories@github.com	https://github.com/JstnMcBrd/dectalk-tts/pull/4
	security-advisories@github.com	https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/JstnMcBrd/dectalk-tts/issues/3
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/JstnMcBrd/dectalk-tts/pull/4
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "dectalk-tts",
          "vendor": "JstnMcBrd",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:jstnmcbrd:dectalk-tts:1.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "dectalk-tts",
          "vendor": "jstnmcbrd",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it."
    },
    {
      "lang": "es",
      "value": "dectalk-tts es un paquete de Nodo para interactuar con la API web aeiou Dectalk. En `dectalk-tts@1.0.0`, las solicitudes de red a la API de terceros se env\u00edan a trav\u00e9s de HTTP, que no est\u00e1 cifrado. Los atacantes pueden interceptar y modificar f\u00e1cilmente el tr\u00e1fico no cifrado. Cualquiera que utilice el paquete podr\u00eda ser v\u00edctima de un ataque de intermediario (MITM). La solicitud de red se actualiz\u00f3 a HTTPS en la versi\u00f3n \"1.0.1\". No existen workarounds, pero algunas precauciones incluyen no enviar informaci\u00f3n confidencial y verificar cuidadosamente la respuesta de la API antes de guardarla."
    }
  ],
  "id": "CVE-2024-31206",
  "lastModified": "2026-06-17T07:27:58.800",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-31206",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-04-05T17:16:09.746920Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-04-04T23:15:15.897",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/issues/3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/pull/4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/issues/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/pull/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-300"
        },
        {
          "lang": "en",
          "value": "CWE-319"
        },
        {
          "lang": "en",
          "value": "CWE-598"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6CF6-8HVR-R68W

Vulnerability from github – Published: 2024-04-04 14:21 – Updated: 2024-04-05 15:44

Summary

dectalk-tts Uses Unencrypted HTTP Request

Details

Impact

In dectalk-tts@1.0.0, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack.

Theft

Because dectalk-tts is a text-to-speech package, user requests are expected to only contain natural language. The package README warns that user input is sent to a third-party API, so users should not send sensitive information regardless.

But if users ignore the warnings and send sensitive information anyway, that information could be stolen by attackers.

Modification

Attackers could manipulate requests to the API. However, the worst a modified request could do is return an incorrect audio file or bad request rejection.

Attackers could also manipulate responses from the API, returning malicious output to the user. Output is expected to be a wav-encoded buffer, which users will likely save to a file. This could be a dangerous entrypoint to the user's filesystem.

Patches

The network request was upgraded to HTTPS in version 1.0.1. No other changes were made, so updating is risk-free.

Workarounds

There are no workarounds, but here are some precautions:

Do not send any sensitive information.
Carefully verify the API response before saving it.

References

Vulnerable code Original report Patch pull request

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "dectalk-tts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-31206"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-300",
      "CWE-319",
      "CWE-598"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-04T14:21:19Z",
    "nvd_published_at": "2024-04-04T23:15:15Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nIn `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a [man-in-the-middle (MITM)](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) attack.\n\n\u003cins\u003eTheft\u003c/ins\u003e\n\nBecause `dectalk-tts` is a text-to-speech package, user requests are expected to only contain natural language. The package [README](https://github.com/JstnMcBrd/dectalk-tts/blob/main/README.md) warns that user input is sent to a third-party API, so users should not send sensitive information regardless.\n\nBut if users ignore the warnings and send sensitive information anyway, that information could be stolen by attackers.\n\n\u003cins\u003eModification\u003c/ins\u003e\n\nAttackers could manipulate requests to the API. However, the worst a modified request could do is return an incorrect audio file or bad request rejection.\n\nAttackers could also manipulate responses from the API, returning malicious output to the user. Output is expected to be a wav-encoded buffer, which users will likely save to a file. This could be a dangerous entrypoint to the user\u0027s filesystem.\n\n### Patches\n\nThe network request was upgraded to HTTPS in version `1.0.1`. No other changes were made, so updating is risk-free.\n\n### Workarounds\n\nThere are no workarounds, but here are some precautions:\n\n- Do not send any sensitive information.\n\n- Carefully verify the API response before saving it.\n\n### References\n\n[Vulnerable code](https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18)\n[Original report](https://github.com/JstnMcBrd/dectalk-tts/issues/3)\n[Patch pull request](https://github.com/JstnMcBrd/dectalk-tts/pull/4)\n",
  "id": "GHSA-6cf6-8hvr-r68w",
  "modified": "2024-04-05T15:44:23Z",
  "published": "2024-04-04T14:21:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31206"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/issues/3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/pull/4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/JstnMcBrd/dectalk-tts"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "dectalk-tts Uses Unencrypted HTTP Request"
}

GSD-2024-31206

Vulnerability from gsd - Updated: 2024-04-03 05:02

Details

Aliases

CVE-2024-31206

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-31206"
      ],
      "details": "dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.",
      "id": "GSD-2024-31206",
      "modified": "2024-04-03T05:02:25.540477Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2024-31206",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "dectalk-tts",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "= 1.0.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "JstnMcBrd"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-300",
                "lang": "eng",
                "value": "CWE-300: Channel Accessible by Non-Endpoint"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-319",
                "lang": "eng",
                "value": "CWE-319: Cleartext Transmission of Sensitive Information"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-598",
                "lang": "eng",
                "value": "CWE-598: Use of GET Request Method With Sensitive Query Strings"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w",
            "refsource": "MISC",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/issues/3",
            "refsource": "MISC",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/issues/3"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/pull/4",
            "refsource": "MISC",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/pull/4"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105",
            "refsource": "MISC",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105"
          },
          {
            "name": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18",
            "refsource": "MISC",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-6cf6-8hvr-r68w",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it."
          },
          {
            "lang": "es",
            "value": "dectalk-tts es un paquete de Nodo para interactuar con la API web aeiou Dectalk. En `dectalk-tts@1.0.0`, las solicitudes de red a la API de terceros se env\u00edan a trav\u00e9s de HTTP, que no est\u00e1 cifrado. Los atacantes pueden interceptar y modificar f\u00e1cilmente el tr\u00e1fico no cifrado. Cualquiera que utilice el paquete podr\u00eda ser v\u00edctima de un ataque de intermediario (MITM). La solicitud de red se actualiz\u00f3 a HTTPS en la versi\u00f3n \"1.0.1\". No existen workarounds, pero algunas precauciones incluyen no enviar informaci\u00f3n confidencial y verificar cuidadosamente la respuesta de la API antes de guardarla."
          }
        ],
        "id": "CVE-2024-31206",
        "lastModified": "2024-04-05T12:40:52.763",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-04T23:15:15.897",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/issues/3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/pull/4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-300"
              },
              {
                "lang": "en",
                "value": "CWE-319"
              },
              {
                "lang": "en",
                "value": "CWE-598"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-31206 (GCVE-0-2024-31206)

FKIE_CVE-2024-31206

GHSA-6CF6-8HVR-R68W

Impact

Patches

Workarounds

References

GSD-2024-31206

Tags

Sightings

Nomenclature

Related by attack behaviour