{"id":"CVE-2019-4013","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-4013","generatedAt":"2026-10-27T21:16:20.166Z","title":"IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges.","description":"IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges. IBM X-Force ID: 155887.","published":"2019-04-10T15:29:00.000Z","lastModified":"2026-06-17T02:36:02.000Z","status":"Modified","sourceIdentifier":"psirt@us.ibm.com","cvss":{"version":"3.0","score":9.9,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-434"],"affected":["ibm/bigfix platform"],"epss":{"score":0.13004,"percentile":0.96304,"date":"2026-10-26","history":[{"date":"2026-09-21","score":0.12191,"percentile":0.96034}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2019-10-07","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":47470,"kind":"exploit","title":"IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload","url":"https://www.exploit-db.com/exploits/47470","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/47470.txt","file":"exploits/java/webapps/47470.txt","published":"2019-10-07","added":"2019-10-07","updated":"2019-10-07","author":"Jakub Palaczynski","type":"webapps","platform":"java","port":null,"verified":false,"codes":["CVE-2019-4013"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 13.0%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/154747/IBM-Bigfix-Platform-9.5.9.62-Arbitary-File-Upload-Code-Execution.html","source":"psirt@us.ibm.com"},{"url":"http://www.ibm.com/support/docview.wss?uid=ibm10874666","tags":["Vendor Advisory"],"source":"psirt@us.ibm.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/155887","tags":["VDB Entry","Vendor Advisory"],"source":"psirt@us.ibm.com"},{"url":"http://packetstormsecurity.com/files/154747/IBM-Bigfix-Platform-9.5.9.62-Arbitary-File-Upload-Code-Execution.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ibm.com/support/docview.wss?uid=ibm10874666","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/155887","tags":["VDB Entry","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-4013","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}