CVE-2021-36460

VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the…

published April 25, 2022

CVSS
—
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Published
2022-04-25T12:03Z
EPSS history
Timeline
  • 25 APR 12:03Z
    VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the…
    cvelistv5