PT-2019-16841 · Ibm · Ibm Bigfix Platform

Published 2019-04-10 · Updated 2019-10-07 · CVE-2019-4013

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM BigFix Platform version 9.5

Description The issue allows any authenticated user to upload files to any location on the server with root privileges, resulting in code execution on the underlying system with root privileges.

Recommendations For IBM BigFix Platform version 9.5, update to a version that includes a fix for this issue to prevent code execution with root privileges.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-4013

Affected Products

Ibm Bigfix Platform

References · 6

• 🔥 https://exploit-db.com/exploits/47470 · Exploit
• http://ibm.com/support/docview.wss?uid=ibm10874666 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4013 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/155887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4013 · Security Note
• http://packetstormsecurity.com/files/154747/IBM-Bigfix-Platform-9.5.9.62-Arbitary-File-Upload-Code-Execution.html · Note