6 matches found
Improper Authentication
Overview In affected versions of botframework-connector, a maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Recommendation Upgrade to fi...
@conversationlearner/sdk (>=0.502.2, <=0.505.2), botbuilder (>=4.7.0, <=4.7.2) +4 more potentially affected by CVE-2021-1725 via botframework-connector (>=4.7.0, <=4.7.2)
botframework-connector NPM version =4.7.0, =0.502.2, =4.7.0, =4.7.0, =1.4.1, =0.505.1, =1.6.0, =1.6.2 Source cves: CVE-2021-1725 Source advisory: OSV:GHSA-FVCJ-HVFW-7F2V...
botbuilder (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0), botbuilder-azure (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0) +2 more potentially affected by CVE-2021-1725 via botframework-connector (>=4.10.0, <=4.10.2-rc0)
botframework-connector NPM version =4.10.0, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.2-rc0-preview - botkit-mock 4.10.0 Source cves: CVE-2021-1725 Source advisory: OSV:GHSA-FVCJ-HVFW-7F2V...
CVE-2021-1725
Bot Framework SDK Information Disclosure Vulnerability...
CVE-2021-1725
CVE-2021-1725 corresponds to a Bot Framework SDK Information Disclosure vulnerability. Connected sources show the issue in the Bot Framework’s botframework-connector component, where a malicious claim could be incorrectly authenticated when bots are not configured as a Skill. The root cause invol...
