VulnerabilityModified
CVE-2021-45036
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
HIGH 7.4EPSS 0.72%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
- CVSS 3.1
- 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-290, CWE-287
- Affected
- velneo/vclient
- Source
- cve-coordination@incibe.es
References
- https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatpsVendor Advisory
- https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserverVendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatpsVendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasenaRelease Notes, Vendor Advisory
- https://velneo.es/mivelneo/listado-de-cambios-velneo-32/Release Notes, Vendor Advisory
- https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0
- https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32Release Notes, Vendor Advisory
- https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatpsVendor Advisory
- https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserverVendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatpsVendor Advisory
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasenaRelease Notes, Vendor Advisory
- https://velneo.es/mivelneo/listado-de-cambios-velneo-32/Release Notes, Vendor Advisory
- https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0
- https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.