VulnerabilityModified
CVE-2019-4013
IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges.
CRITICAL 9.9EPSS 13.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges. IBM X-Force ID: 155887.
- CVSS 3.0
- 9.9 CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 13.86% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- ibm/bigfix platform
- Source
- psirt@us.ibm.com
References
- http://packetstormsecurity.com/files/154747/IBM-Bigfix-Platform-9.5.9.62-Arbitary-File-Upload-Code-Execution.html
- http://www.ibm.com/support/docview.wss?uid=ibm10874666Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/155887VDB Entry, Vendor Advisory
- http://packetstormsecurity.com/files/154747/IBM-Bigfix-Platform-9.5.9.62-Arbitary-File-Upload-Code-Execution.html
- http://www.ibm.com/support/docview.wss?uid=ibm10874666Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/155887VDB Entry, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.