PT-2021-24455 · Microsoft · Bot Builder Sdk
Published
2021-03-08
·
Updated
2021-03-08
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
Microsoft Bot Builder SDK (affected versions not specified)
Description:
A maliciously crafted claim may be incorrectly authenticated by the bot, requiring an attacker to have internal knowledge of the bot. This issue affects bots not configured to be used as a Skill.
Recommendations:
For all affected versions, update to a patched version.
As a temporary workaround, consider adding an authentication configuration containing ClaimsValidator which throws an exception if the Claims are Skill Claims.
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bot Builder Sdk