CVE-2021-45035
Assigner: INCIBE
Published: 2022-09-16T00:00:00
State: PUBLISHED
affected: product: Velneo vClient
vendor: Velneo
versions: status: affected
version: 28.1.3
datePublic: 2022-09-16T00:00:00
descriptions: value: Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-287
description: CWE-287 Improper Authentication
type: CWE
solutions: value: This vulnerability has been fixed by Velneo team in the 29.2 version, released on 29/06/2021.
source: discovery: EXTERNAL
title: Velneo vClient Improper authentication
x_generator: engine: Vulnogram 0.0.9