CVE-2024-31206

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.
Configurations

No configuration.

History

05 Apr 2024, 12:40

Type Values Removed Values Added
Summary
  • (es) dectalk-tts es un paquete de Nodo para interactuar con la API web aeiou Dectalk. En `dectalk-tts@1.0.0`, las solicitudes de red a la API de terceros se envían a través de HTTP, que no está cifrado. Los atacantes pueden interceptar y modificar fácilmente el tráfico no cifrado. Cualquiera que utilice el paquete podría ser víctima de un ataque de intermediario (MITM). La solicitud de red se actualizó a HTTPS en la versión "1.0.1". No existen workarounds, pero algunas precauciones incluyen no enviar información confidencial y verificar cuidadosamente la respuesta de la API antes de guardarla.

04 Apr 2024, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-04-04 23:15

Updated : 2024-04-05 12:40


NVD link : CVE-2024-31206

Mitre link : CVE-2024-31206

CVE.ORG link : CVE-2024-31206


JSON object : View

Products Affected

No product.

CWE
CWE-300

Channel Accessible by Non-Endpoint

CWE-319

Cleartext Transmission of Sensitive Information

CWE-598

Use of GET Request Method With Sensitive Query Strings