CVE-2021-36460 Vulnerability Details

  /     /     /  

CVE-2021-36460 Metadata Quick Info

CVE Published: 25/04/2022 | CVE Updated: 04/08/2024 | CVE Year: 2021
Source: mitre | Vendor: n/a | Product: n/a
Status : PUBLISHED

---

CVE-2021-36460 Description

VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account\'s password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user\'s account, rendering the benefits of storing hashed passwords in the database useless.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: n/a
Source: n/a

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description: