CVE-2024-31206

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.
Configurations

No configuration.

History

21 Nov 2024, 09:13

Type Values Removed Values Added
References () https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18 - () https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18 -
References () https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105 - () https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105 -
References () https://github.com/JstnMcBrd/dectalk-tts/issues/3 - () https://github.com/JstnMcBrd/dectalk-tts/issues/3 -
References () https://github.com/JstnMcBrd/dectalk-tts/pull/4 - () https://github.com/JstnMcBrd/dectalk-tts/pull/4 -
References () https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w - () https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w -

05 Apr 2024, 12:40

Type Values Removed Values Added
Summary
  • (es) dectalk-tts es un paquete de Nodo para interactuar con la API web aeiou Dectalk. En `dectalk-tts@1.0.0`, las solicitudes de red a la API de terceros se envían a través de HTTP, que no está cifrado. Los atacantes pueden interceptar y modificar fácilmente el tráfico no cifrado. Cualquiera que utilice el paquete podría ser víctima de un ataque de intermediario (MITM). La solicitud de red se actualizó a HTTPS en la versión "1.0.1". No existen workarounds, pero algunas precauciones incluyen no enviar información confidencial y verificar cuidadosamente la respuesta de la API antes de guardarla.

04 Apr 2024, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-04-04 23:15

Updated : 2024-11-21 09:13


NVD link : CVE-2024-31206

Mitre link : CVE-2024-31206

CVE.ORG link : CVE-2024-31206


JSON object : View

Products Affected

No product.

CWE
CWE-300

Channel Accessible by Non-Endpoint

CWE-319

Cleartext Transmission of Sensitive Information

CWE-598

Use of GET Request Method With Sensitive Query Strings