Velneo vClient improper authentication
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.7%
exploitation probability
0.7%top 47% of all CVEs
observed exploitation
nono source reports it
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
Velneo · Velneo vClientReferences
https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserverhttps://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatpshttps://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasenahttps://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatpshttps://velneo.es/mivelneo/listado-de-cambios-velneo-32/https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32