Improper Authentication Affecting botframework-connector package, versions >=4.10.0 <4.10.3 >=4.9.0 <4.9.4 >=4.8.0 <4.8.1 >=4.7.0 <4.7.3


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-BOTFRAMEWORKCONNECTOR-1083277
  • published 9 Mar 2021
  • disclosed 8 Mar 2021
  • credit Unknown

How to fix?

Upgrade botframework-connector to version 4.10.3, 4.9.4, 4.8.1, 4.7.3 or higher.

Overview

botframework-connector is a Bot Connector is autorest generated connector client.

Affected versions of this package are vulnerable to Improper Authentication. A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
7.5 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    High
Expand this section

NVD

5.5 medium