Main Vulnerability Database Vulnerabilities #VU49488

Information disclosure in Microsoft products - CVE-2021-1725

Published: January 12, 2021

Vulnerability identifier: #VU49488

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1725

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Bot Framework SDK. A local user can gain unauthorized access to sensitive information on the system.

Affected software

Bot Framework SDK for Python
Bot Framework SDK for JavaScript
Bot Framework SDK for .NET Framework

How to mitigate CVE-2021-1725

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1725

Related Security Bulletins