CVE-2019-11233

Published: Jun 19, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element to the auth/main/asp/check_user_login_info.aspx URI, and then reading the response, as demonstrated by the KW_EMAIL or KW_TEL field.

Affected (1)

Products: Eic: Biyan

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eic Biyan	From 1.57 to 2.8

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://gist.github.com/keniver/dd27ba44d0aef4318551e647d927242f

Source: cve@mitre.org

ExploitThird Party Advisory

https://gist.github.com/keniver/dd27ba44d0aef4318551e647d927242f

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.