CVE-2024-31206

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-31206

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-31206.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-31206

Aliases

GHSA-6cf6-8hvr-r68w

Published

2024-04-04T22:10:29.200Z

Modified

2025-11-30T18:50:37.212150Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator

Summary

Use of Unencrypted HTTP Request in dectalk-tts

Details

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In dectalk-tts@1.0.0, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version 1.0.1. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31206.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-300",
        "CWE-319",
        "CWE-598"
    ]
}

References

Affected packages

Git / github.com/jstnmcbrd/dectalk-tts

Affected ranges

Type: GIT
Repo: https://github.com/jstnmcbrd/dectalk-tts
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

3600d8ac156f27da553ac4ead46d16989a350105

Affected versions

v1.*

v1.0.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-31206.json"