PT-2019-11507 · Unknown · Voice Builder

Published 2019-07-23 · Updated 2019-10-09 · CVE-2019-1010200

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Voice Builder versions prior to commit f6660e6d8f0d1d931359d591dbdec580fef36d36

Description: The issue affects two web servers in the project, exposing three vulnerable endpoints that can be accessed remotely, specifically at "/tts" and "/alignment". An attacker can send a GET request to the vulnerable endpoint with a specially formatted query parameter, potentially leading to remote code execution with the same privileges as the servers.

Recommendations: For versions prior to commit f6660e6d8f0d1d931359d591dbdec580fef36d36, update to a version after commit f6660e6d8f0d1d931359d591dbdec580fef36d36 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints "/tts" and "/alignment" to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-1010200

Affected Products

Voice Builder

References · 4

• https://github.com/google/voice-builder/commit/f6660e6d8f0d1d931359d591dbdec580fef36d36 · Patch
• https://github.com/google/voice-builder/commit/c145d4604df67e6fc625992412eef0bf9a85e26b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010200 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1010200 · Vendor Advisory