{"data":{"id":"4526c002-0b02-4a34-ad80-b439fa7cd6c7","title":"CVE-2025-32377: Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language…","summary":"Voice connectors in Rasa Pro do not properly enforce authentication, even when a token is set in credentials.yml. An attacker can submit voice data to a Rasa Pro assistant without authenticating.","solution":"Patched for the audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-32377","publishedAt":"2025-04-18T20:15:16.670Z","cveId":"CVE-2025-32377","cweIds":["CWE-306"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["rasa-pro@>= 3.12.0, <= 3.12.5 (fixed: 3.12.6)","rasa-pro@>= 3.11.0, <= 3.11.6 (fixed: 3.11.7)","rasa-pro@>= 3.10.0, <= 3.10.18 (fixed: 3.10.19)","rasa-pro@<= 3.9.17 (fixed: 3.9.20)"],"affectedPackageNames":["rasa-pro"],"affectedPackageRefs":["pypi:rasa-pro"],"affectedVendors":[],"affectedVendorsRaw":["Rasa Pro"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Rasa Pro voice connectors missing authentication despite configured token","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00472,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":["GHSA-7xq5-54jp-2mfg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:56.029Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-04-14T14:41:40.308Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:44:39.678Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"rasa-pro","fixedVersion":"3.10.19","matchedVersion":"3.10.19","fixReleasedAt":"2025-04-15T11:07:08.275Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:44:39.528Z"},{"ecosystem":"pypi","name":"rasa-pro","fixedVersion":"3.11.7","matchedVersion":"3.11.7","fixReleasedAt":"2025-04-15T08:44:43.320Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:44:39.528Z"},{"ecosystem":"pypi","name":"rasa-pro","fixedVersion":"3.12.6","matchedVersion":"3.12.6","fixReleasedAt":"2025-04-15T10:52:09.559Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:44:39.528Z"},{"ecosystem":"pypi","name":"rasa-pro","fixedVersion":"3.9.20","matchedVersion":"3.9.20","fixReleasedAt":"2025-04-14T14:41:40.308Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:44:39.528Z"}]}}