botframework-connector vulnerable to Improper Authentication

Description

A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot.

Recommendation

Update the botframework-connector package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.10.0, < 4.10.3

  >= 4.9.0, < 4.9.4

  = 4.8.0

  >= 4.7.0, < 4.7.3**

• Patched version(s): **4.10.3

  4.9.4

  4.8.1

  4.7.3**

References

• GHSA-fvcj-hvfw-7f2v
• aka.ms
• www.npmjs.com
• portal.msrc.microsoft.com
• CVE-2021-1725
• CWE-200
• CWE-287
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - html-parse-stringify - CVE-2021-23346
• Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS - CVE-2026-40171
• inflect vulnerable to Inefficient Regular Expression Complexity - CVE-2021-3820
• merge vulnerable to Prototype Pollution - CVE-2021-3645

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

botframework-connector