{"action":"Upgrade botframework-connector to 4.7.3 or later.","affected":[{"fixed":"4.7.3","introduced":"4.7.0"},{"fixed":"4.8.1","introduced":"4.8.0"},{"fixed":"4.9.4","introduced":"4.9.0"},{"fixed":"4.10.3","introduced":"4.10.0"}],"component":"botframework-connector","cve_ids":["CVE-2021-1725"],"ecosystem":"npm","epss":0.01074,"exploited":false,"fixed_versions":["4.7.3","4.8.1","4.9.4","4.10.3"],"ghsa_id":"GHSA-fvcj-hvfw-7f2v","id":"tcs_01M5KFPANXN0EPDXMQ4H6DSYKV","modified_at":"2024-01-02T15:05:56Z","published_at":"2021-03-08T15:49:53Z","references":["https://osv.dev/vulnerability/GHSA-fvcj-hvfw-7f2v","https://github.com/microsoft/botbuilder-js/security/advisories/GHSA-fvcj-hvfw-7f2v","https://nvd.nist.gov/vuln/detail/CVE-2021-1725","https://aka.ms/SkillClaimsValidationJavascript","https://github.com/microsoft/botbuilder-js","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1725","https://www.npmjs.com/package/botframework-connector"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-fvcj-hvfw-7f2v","url":"https://osv.dev/vulnerability/GHSA-fvcj-hvfw-7f2v"}],"summary":"botframework-connector vulnerable to Improper Authentication"}