CVE-2025-32377
MEDIUMRasa Pro 3.9.0-3.9.19, 3.10.0-3.10.18, 3.11.0-3.11.6, 3.12.0-3.12.5 - Unauthenticated Voice Data Submission
Title source: llmDescription
Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://github.com/RasaHQ/security-advisories/security/advisories/GHSA-7xq5-54jp-2mfg
Scores
CVSS v3
6.5
EPSS
0.0024
EPSS Percentile
47.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-306
Status
published
Products (5)
pypi/rasa-pro
3.12.0 - 3.12.6PyPI
RasaHQ/rasa-pro-security-advisories
< 3.9.20
RasaHQ/rasa-pro-security-advisories
>= 3.10.0, < 3.10.19
RasaHQ/rasa-pro-security-advisories
>= 3.11.0, < 3.11.7
RasaHQ/rasa-pro-security-advisories
>= 3.12.0, < 3.12.6
Published
Apr 18, 2025
Tracked Since
Feb 18, 2026