CVE-2019-11233 Information

Description

EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated by sending a LOGIN_ID element to the auth/main/asp/check_user_login_info.aspx URI and then reading the response as demonstrated by the KW_EMAIL or KW_TEL field.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://gist.github.com/keniver/dd27ba44d0aef4318551e647d927242f

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

7.5