PT-2021-19807 · Unknown · Veryfitpro

Nick Decker · Published 2021-06-16 · Updated 2021-07-12 · CVE-2021-32612

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VeryFitPro version 3.2.8

Description The VeryFitPro application communicates with the backend API over cleartext HTTP, which includes logins, registrations, and password change requests. This allows information theft and account takeover via network sniffing.

Recommendations For version 3.2.8, consider disabling communication with the backend API until a secure connection method is implemented, such as HTTPS, to prevent information theft and account takeover. Restrict access to sensitive information, such as login credentials and password change requests, to minimize the risk of exploitation.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-32612

Affected Products

Veryfitpro

References · 9

• 🔥 https://trovent.github.io/security-advisories/TRSA-2105-01/TRSA-2105-01.txt · Exploit
• 🔥 http://seclists.org/fulldisclosure/2021/Jun/45 · Exploit
• 🔥 https://trovent.io/security-advisory-2105-01 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-32612 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32612 · Vendor Advisory
• https://play.google.com/store/apps/details?id=com.veryfit2hr.second&hl=en_US&gl=US · Note
• https://t.me/cvenotify/17479 · Telegram Post
• https://t.me/defcon_news/79034 · Telegram Post
• https://t.me/cvenotify/16549 · Telegram Post