CVE-2019-11367

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute. By using this account and password, anyone can login successfully.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-311 CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.htmlExploit, Third Party Advisory, VDB Entry
https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/viewExploit, Third Party Advisory
https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367Exploit, Third Party Advisory
http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.htmlExploit, Third Party Advisory, VDB Entry
https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/viewExploit, Third Party Advisory
https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367Exploit, Third Party Advisory

Timeline

Published: Jun 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-113685.4Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.CVE-2019-113698.8An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may all CVE-2019-11375.4A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request CVE-2019-113705.4Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.CVE-2019-113719.8BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at CVE-2019-113726.5An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 le CVE-2019-113736.5An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.CVE-2019-113748.874CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.CVE-2019-113756.5Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.CVE-2019-113767.2SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicate CVE-2019-113778.8wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension a CVE-2019-113788.8An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for us