PT-2022-12298 · Velneo · Velneo Vclient

Jesús Ródenas Huerta + 1 · Published 2022-11-28 · Updated 2024-09-16 · CVE-2021-45036

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Velneo vClient version 28.1.3

Description The issue allows an attacker with knowledge of the victim's username and hashed password to spoof the victim's id against the server.

Recommendations For Velneo vClient version 28.1.3, consider restricting access to sensitive operations that rely on the victim's id until a patch is available. As a temporary workaround, ensure that the server-side validation of user identities is enhanced to prevent spoofing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-287

CWE-290

Related Identifiers

CVE-2021-45036

Affected Products

Velneo Vclient

References · 11

• https://osv.dev/vulnerability/CVE-2021-45036 · Vendor Advisory
• https://velneo.es/mivelneo/listado-de-cambios-velneo-32 · Vendor Advisory
• https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver · Vendor Advisory
• https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena · Vendor Advisory
• https://velneo.com/blog/disponible-la-nueva-version-velneo-32 · Vendor Advisory
• https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45036 · Security Note
• https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps · Vendor Advisory
• https://t.me/cibsecurity/53584 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0 · Note
• https://t.me/cvenotify/38599 · Telegram Post