CVE-2021-45035

medium

Description

Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

References

https://www.velneo.com/blog/nueva-revision-velneo-29-2

https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication

https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/

https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados

Details

Source: Mitre, NVD

Published: 2022-09-23

Updated: 2023-07-21

Risk Information

CVSS v2

Base Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N