Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
References
Link | Resource |
---|---|
https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps | Vendor Advisory |
https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver | Vendor Advisory |
https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps | Vendor Advisory |
https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena | Release Notes Vendor Advisory |
https://velneo.es/mivelneo/listado-de-cambios-velneo-32/ | Release Notes Vendor Advisory |
https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0 | |
https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32 | Release Notes Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: INCIBE
Published: 2022-11-23T00:00:00
Updated: 2023-11-09T16:02:44.992Z
Reserved: 2021-12-13T00:00:00
Link: CVE-2021-45036
JSON object: View
NVD Information
Status : Modified
Published: 2022-11-28T16:15:09.090
Modified: 2023-11-09T16:15:34.337
Link: CVE-2021-45036
JSON object: View
Redhat Information
No data.