CVE-2021-45036

Summary

Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.

Affected Software

Weaknesses

• CWE-290: CWE-290 Authentication Bypass by Spoofing

ADP Enrichment

CVE Program Container

Additional References

• https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0
• https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32
• https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena
• https://velneo.es/mivelneo/listado-de-cambios-velneo-32/
• https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps
• https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps
• https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0
• https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32
• https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena
• https://velneo.es/mivelneo/listado-de-cambios-velneo-32/
• https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps
• https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps
• https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver

• ←Previous
• Next→