{"action":"Upgrade botframework-connector to 4.7.2 or later.","affected":[{"fixed":"4.7.2","introduced":"4.7.0"},{"fixed":"4.8.1","introduced":"4.8.0"},{"fixed":"4.9.3","introduced":"4.9.0"},{"fixed":"4.10.1","introduced":"4.10.0"}],"component":"botframework-connector","cve_ids":["CVE-2021-1725"],"ecosystem":"PyPI","epss":0.01074,"exploited":false,"fixed_versions":["4.7.2","4.8.1","4.9.3","4.10.1"],"ghsa_id":"GHSA-cqff-fx2x-p86v","id":"tcs_01M5KFDGYQKCQZYZK5X7E3MQ14","modified_at":"2024-12-05T05:26:06.739298Z","published_at":"2021-03-08T15:50:10Z","references":["https://osv.dev/vulnerability/GHSA-cqff-fx2x-p86v","https://github.com/microsoft/botbuilder-python/security/advisories/GHSA-cqff-fx2x-p86v","https://github.com/microsoft/botbuilder-python/blob/main/doc/SkillClaimsValidation.md","https://github.com/pypa/advisory-database/tree/main/vulns/botframework-connector/PYSEC-2021-422.yaml","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1725","https://pypi.org/project/botframework-connector"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-cqff-fx2x-p86v","url":"https://osv.dev/vulnerability/GHSA-cqff-fx2x-p86v"}],"summary":"botframework-connector vulnerable to Improper Authentication"}