Unscored CVE-2019-11367 EUVD-2019-3045GHSA-89gq-fxm9-f6xg

An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and…

Published Jun 3, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute. By using this account and password, anyone can login successfully.

References

https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/view
https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367
http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.html