7.8

CVE-2021-36460

Exploit
VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Veryfitpro Project ≫ Veryfitpro SwPlatformandroid Version <= 3.3.7
Veryfitpro Project ≫ Veryfitpro SwPlatformiphone_os Version <= 3.3.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.324
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://veryfitpro.com
Third Party Advisory
URL Repurposed
Not Applicable
http://www.i-doo.cn
Not Applicable
https://github.com/martinfrancois/CVE-2021-36460
Third Party Advisory
Exploit
Mitigation