CVE-2019-11233

HIGH

BiYan 1.57-2.8 - Unauthenticated Exposure of Sensitive Information via Login Info Endpoint

Title source: llm
STIX 2.1

Description

EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element to the auth/main/asp/check_user_login_info.aspx URI, and then reading the response, as demonstrated by the KW_EMAIL or KW_TEL field.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://gist.github.com/keniver/dd27ba44d0aef4318551e647d927242f

Scores

CVSS v3 7.5
EPSS 0.0150
EPSS Percentile 71.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
eic/biyan 1.57 - 2.8
Published Jun 19, 2019
Tracked Since Feb 18, 2026