CERT/CC VINCE versions 3.0.38 and earlier suffer from insufficient verification of data authenticity (CWE-345) related to the From address in incoming communications. Due to encoding confusion, the software may incorrectly trust the From address, enabling automated processes like ticket creation or updates to be triggered by potentially spoofed addresses. This vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity but not availability. No patch or official remediation level is currently documented, and no exploits are known in the wild.

The vulnerability could allow an attacker to spoof the From address in communications to VINCE, causing unauthorized automated ticket creation or updates. This may lead to information disclosure or integrity issues within the ticketing system. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vince for current remediation guidance. Until an official fix is available, organizations should consider restricting access to VINCE interfaces and monitoring for suspicious ticket creation or updates that may indicate exploitation attempts.