CVE-2019-9884: eClass platform contains a Broken Access Control vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-07-25 · updated 2026-06-17
Weakness: CWE-284

Description

eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.

Affected products

BroadLearning eclass: before 2.5.10.2.1 — fixed in 2.5.10.2.1

How to fix

Upgrade to a fixed version: BroadLearning eclass 2.5.10.2.1. Check the vendor advisory for mitigations.

References

http://surl.twcert.org.tw/b7jfz
https://tvn.twcert.org.tw/taiwanvn/TVN-201904004
https://zeroday.hitcon.org/vulnerability/ZD-2019-00332
http://surl.twcert.org.tw/b7jfz
https://tvn.twcert.org.tw/taiwanvn/TVN-201904004
https://zeroday.hitcon.org/vulnerability/ZD-2019-00332

Get alerted when CVE-2019-9884 or the next vulnerability affects your stack