CVE-2021-45036: high-severity vulnerability in Velneo vClient
Velneo vClient improper authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.8%
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
Velneo · Velneo vClientRelated CVEs — Velneo vClient
In the same product, most dangerous first.
References
https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserverhttps://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatpshttps://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasenahttps://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatpshttps://velneo.es/mivelneo/listado-de-cambios-velneo-32/https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32