Skip to content
Fencer Vulns
critical 9.0

CVE-2019-4013 in the critical feed json

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges.

published 2019-04-10 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13620

cvss
9.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
13.0%
EPSS 13.0% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB

Summary

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges. IBM X-Force ID: 155887.

Timeline

  1. Published
  2. First public exploit (EDB-47470)

Exploit prediction

13.00% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-47470 IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload webapps, 2019-10-07

CVSS scores

assigned by version score vector
CNA 3.0 9.0 CVSS:3.0/AC:L/C:H/UI:R/A:H/I:H/PR:L/S:C/AV:N/RC:C/RL:O/E:U
CNA 3.0 9.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD 3.0 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

  • IBM BigFix Platform

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.