CVEvulnerability

CVE-2021-36460

7.8 HIGH Published 2022-04-25 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2022-04-25
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.

Affected configurations

• veryfitpro project veryfitpro (<= 3.3.7)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References