CVE-2021-1725: Bot Framework SDK Information Disclosure Vulnerability

Overview

Severity
Medium (CVSS 5.5)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2021-Jan
Released
2021-01-12
EPSS Score
0.52% (percentile: 66.9%)

FAQ

How do I know if I need to install the update? Customers using Bot Framework SDK with versions shown in the Security Update Applies To column in the following table affected by this vulnerability. SDK Unaffected Versions Prior To Security Update Applies To Unaffected Versions Greater Than .NET Framework 4.6.0 4.6.0 - 4.10.2 4.10.2 JavaScript 4.7.0 4.7.0 - 4.10.1 4.10.1 Python 4.7.0 4.7.0 - 4.10.0 4.10.0 What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is sensitive information.

Affected Products (3)

Developer Tools

  • Bot Framework SDK for .NET Framework
  • Bot Framework SDK for JavaScript
  • Bot Framework SDK for Python

Security Updates (3)

Revision History

  • 2021-01-12: Information published.