CVE-2021-45036
Velneo vClient improper authentication
- State
- Published
- Severity
- 8.7 High
- Published
- Nov 28, 2022
- Updated
- Apr 25, 2025
- Reserved
- Dec 13, 2021
Description
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.7 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | INCIBE |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
Velneo vClientVelneo |
|
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0
- https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena
- https://velneo.es/mivelneo/listado-de-cambios-velneo-32/
- https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps
- https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps
- https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.