CVE-2021-36460 (GCVE-0-2021-36460)

Vulnerability from cvelistv5 – Published: 2022-04-25 12:03 – Updated: 2024-08-04 00:54
VLAI?
Summary
VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:54:51.522Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://veryfitpro.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.i-doo.cn"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/martinfrancois/CVE-2021-36460"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account\u0027s password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user\u0027s account, rendering the benefits of storing hashed passwords in the database useless."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-25T12:03:38.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://veryfitpro.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.i-doo.cn"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/martinfrancois/CVE-2021-36460"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-36460",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account\u0027s password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user\u0027s account, rendering the benefits of storing hashed passwords in the database useless."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://veryfitpro.com",
              "refsource": "MISC",
              "url": "http://veryfitpro.com"
            },
            {
              "name": "http://www.i-doo.cn",
              "refsource": "MISC",
              "url": "http://www.i-doo.cn"
            },
            {
              "name": "https://github.com/martinfrancois/CVE-2021-36460",
              "refsource": "MISC",
              "url": "https://github.com/martinfrancois/CVE-2021-36460"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-36460",
    "datePublished": "2022-04-25T12:03:38.000Z",
    "dateReserved": "2021-07-12T00:00:00.000Z",
    "dateUpdated": "2024-08-04T00:54:51.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-36460",
      "date": "2026-04-25",
      "epss": "0.00125",
      "percentile": "0.31385"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:veryfitpro_project:veryfitpro:*:*:*:*:*:android:*:*\", \"versionEndIncluding\": \"3.3.7\", \"matchCriteriaId\": \"C0FAAA0B-DCD4-44BA-8159-0FF7BFC5A670\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:veryfitpro_project:veryfitpro:*:*:*:*:*:iphone_os:*:*\", \"versionEndIncluding\": \"3.3.7\", \"matchCriteriaId\": \"7CB1B977-9AD4-40EC-8B44-91D4CDF59436\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account\u0027s password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user\u0027s account, rendering the benefits of storing hashed passwords in the database useless.\"}, {\"lang\": \"es\", \"value\": \"VeryFitPro (com.veryfit2hr.second) versi\\u00f3n 3.2.8, cifra la contrase\\u00f1a de la cuenta localmente en el dispositivo y usa el hash para autenticar en toda la comunicaci\\u00f3n con la API del backend, incluyendo el inicio de sesi\\u00f3n, el registro y el cambio de contrase\\u00f1as. Esto permite a un atacante en posesi\\u00f3n del hash tomar el control de la cuenta de un usuario, haciendo in\\u00fatiles las ventajas de almacenar las contrase\\u00f1as con hash en la base de datos\"}]",
      "id": "CVE-2021-36460",
      "lastModified": "2024-11-21T06:13:44.960",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 4.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-04-25T13:15:49.330",
      "references": "[{\"url\": \"http://veryfitpro.com\", \"source\": \"cve@mitre.org\", \"tags\": [\"Not Applicable\", \"Third Party Advisory\", \"URL Repurposed\"]}, {\"url\": \"http://www.i-doo.cn\", \"source\": \"cve@mitre.org\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://github.com/martinfrancois/CVE-2021-36460\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"http://veryfitpro.com\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\", \"Third Party Advisory\", \"URL Repurposed\"]}, {\"url\": \"http://www.i-doo.cn\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://github.com/martinfrancois/CVE-2021-36460\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-36460\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-04-25T13:15:49.330\",\"lastModified\":\"2024-11-21T06:13:44.960\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account\u0027s password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user\u0027s account, rendering the benefits of storing hashed passwords in the database useless.\"},{\"lang\":\"es\",\"value\":\"VeryFitPro (com.veryfit2hr.second) versi\u00f3n 3.2.8, cifra la contrase\u00f1a de la cuenta localmente en el dispositivo y usa el hash para autenticar en toda la comunicaci\u00f3n con la API del backend, incluyendo el inicio de sesi\u00f3n, el registro y el cambio de contrase\u00f1as. Esto permite a un atacante en posesi\u00f3n del hash tomar el control de la cuenta de un usuario, haciendo in\u00fatiles las ventajas de almacenar las contrase\u00f1as con hash en la base de datos\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:veryfitpro_project:veryfitpro:*:*:*:*:*:android:*:*\",\"versionEndIncluding\":\"3.3.7\",\"matchCriteriaId\":\"C0FAAA0B-DCD4-44BA-8159-0FF7BFC5A670\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:veryfitpro_project:veryfitpro:*:*:*:*:*:iphone_os:*:*\",\"versionEndIncluding\":\"3.3.7\",\"matchCriteriaId\":\"7CB1B977-9AD4-40EC-8B44-91D4CDF59436\"}]}]}],\"references\":[{\"url\":\"http://veryfitpro.com\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Third Party Advisory\",\"URL Repurposed\"]},{\"url\":\"http://www.i-doo.cn\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/martinfrancois/CVE-2021-36460\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://veryfitpro.com\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Third Party Advisory\",\"URL Repurposed\"]},{\"url\":\"http://www.i-doo.cn\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/martinfrancois/CVE-2021-36460\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.