CVEvulnerability
CVE-2021-45036
7.4 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-11-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.7 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-287, CWE-290
Description
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
Affected configurations
• velneo vclient 28.1.3
Related
References
- https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps Vendor Advisory
- https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver Vendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps Vendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena Release Notes, Vendor Advisory
- https://velneo.es/mivelneo/listado-de-cambios-velneo-32/ Release Notes, Vendor Advisory
- https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0 www.incibe.es
- https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32 Release Notes, Vendor Advisory
- https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps Vendor Advisory
- https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver Vendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps Vendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena Release Notes, Vendor Advisory
- https://velneo.es/mivelneo/listado-de-cambios-velneo-32/ Release Notes, Vendor Advisory
- https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0 www.incibe.es
- https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32 Release Notes, Vendor Advisory