PT-2019-11507 · Unknown · Voice Builder

Publicado 2019-07-23 · Atualizado 2019-10-09 · CVE-2019-1010200

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Voice Builder versions prior to commit f6660e6d8f0d1d931359d591dbdec580fef36d36

Description: The issue affects two web servers in the project, exposing three vulnerable endpoints that can be accessed remotely, specifically at "/tts" and "/alignment". An attacker can send a GET request to the vulnerable endpoint with a specially formatted query parameter, potentially leading to remote code execution with the same privileges as the servers.

Recommendations: For versions prior to commit f6660e6d8f0d1d931359d591dbdec580fef36d36, update to a version after commit f6660e6d8f0d1d931359d591dbdec580fef36d36 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints "/tts" and "/alignment" to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-1010200

Produtos afetados

Voice Builder

Referências · 4

• https://github.com/google/voice-builder/commit/f6660e6d8f0d1d931359d591dbdec580fef36d36 · Correção
• https://github.com/google/voice-builder/commit/c145d4604df67e6fc625992412eef0bf9a85e26b · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010200 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1010200 · Aviso do Fabricante