Velneo vClient improper authentication
CVE-2021-45036

7.4HIGH

Key Information:

Vendor: Velneo
Status: Velneo Vclient
Vendor: CVE Published:; 28 November 2022

What is CVE-2021-45036?

Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.

Affected Version(s)

Velneo vClient 28.1.3

References

https://www.incibe.es/en/incibe-cert/notices/aviso/velneo...

https://www.velneo.com/blog/disponible-la-nueva-version-v...

https://doc.velneo.com/v/32/velneo/notas-de-la-version#me...

CVSS V3.1

Score:

7.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 28, 2022
Vulnerability Reserved
Dec 13, 2021

Credit

Jesús Ródenas Huerta, @Marmeus

CVE-2021-45036 Data

JSON