PT-2025-17344 · Rasa · Rasa Pro

Aerowithanl · Published 2025-04-17 · Updated 2025-04-19 · CVE-2025-32377

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Rasa Pro versions prior to 3.9.20 Rasa Pro versions prior to 3.10.19 Rasa Pro versions prior to 3.11.7 Rasa Pro versions prior to 3.12.6

Description A vulnerability has been identified in Rasa Pro where voice connectors do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.

Recommendations For versions prior to 3.9.20, update to version 3.9.20 or later to resolve the issue. For versions prior to 3.10.19, update to version 3.10.19 or later to resolve the issue. For versions prior to 3.11.7, update to version 3.11.7 or later to resolve the issue. For versions prior to 3.12.6, update to version 3.12.6 or later to resolve the issue. As a temporary workaround, consider restricting access to voice connectors until a patch is applied.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-32377

GHSA-7XQ5-54JP-2MFG

Affected Products

Rasa Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-32377 · Security Note
• https://osv.dev/vulnerability/GHSA-7xq5-54jp-2mfg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32377 · Vendor Advisory
• https://twitter.com/CVEnew/status/1913455457785479383 · Twitter Post
• https://t.me/cvetracker/21958 · Telegram Post
• https://github.com/RasaHQ/rasa-pro-security-advisories/security/advisories/GHSA-7xq5-54jp-2mfg · Note
• https://github.com/RasaHQ/security-advisories/security/advisories/GHSA-7xq5-54jp-2mfg · Note
• https://t.me/cvedetector/23346 · Telegram Post