AVID-2026-R0711

Description

Bot Framework SDK Information Disclosure Vulnerability (CVE-2021-1725)

Details

Bot Framework SDK Information Disclosure Vulnerability

Reason for inclusion in AVID: CVE-2021-1725 is a software vulnerability in the Bot Framework SDK (for .NET, JavaScript, and Python) that leads to information disclosure. The Bot Framework SDK is a software component used to build and deploy AI-enabled chatbots and related AI services, making it part of the software stack for general-purpose AI systems. This is a security/vulnerability issue in a dependency used to develop/run AI applications, thus a software supply chain concern for AI systems. The CVE is documented with references (NVD/MSRC) and describes a disclosure risk, meeting the evidence criteria.

References

• NVD entry
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1725

Affected or Relevant Artifacts

• Developer: Microsoft
• Deployer: Microsoft
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2021-01-12
• Version: 0.3.3
• AVID Entry