CVE-2019-4061mediumobserved exploitation

CVE-2019-4061: medium-severity vulnerability in IBM BigFix Platform

Published · Updated

55Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.3epss 23%
from disclosure to weapon19 days
Published on NVDFeb 27
metasploit+19d
VulnCheck+1867d
exploitation probability
23%top 2% of all CVEs
observed exploitation
yesVulnCheck
In short

IBM BigFix Platform versions 9.2 and 9.5 allow attackers to remotely query relay servers without authentication to discover what updates and security patches are deployed across the network. This information leak can help attackers plan targeted attacks against known vulnerabilities.

Technical detail

An unauthenticated attacker can query the BigFix relay server remotely to enumerate deployed fixlets and updates across associated sites due to missing authentication controls. This information disclosure vulnerability enables reconnaissance of the target environment's patch status and security posture without requiring credentials.

Summary generated and translated by AI from the official description.
IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associated sites due to not enabling authenticated access. IBM X-Force ID: 156869.
CVSS:3.0/A:N/AC:L/AV:N/C:L/I:N/PR:N/S:U/UI:N/E:U/RC:C/RL:O
Affected products
IBM · BigFix Platform
Related CVEs — IBM BigFix Platform

In the same product, most dangerous first.

CVE-2019-4013CRITICALCVE-2019-4013EPSS 13.0%CVE-2018-1475—CVE-2018-1475EPSS 2.2%CVE-2017-1221—CVE-2017-1221EPSS 1.6%CVE-2018-1476MEDIUMCVE-2018-1476EPSS 1.4%CVE-2017-1227—CVE-2017-1227EPSS 1.4%CVE-2018-1481LOWCVE-2018-1481EPSS 1.2%
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/156869http://www.ibm.com/support/docview.wss?uid=ibm10870242http://www.rapid7.com/db/modules/auxiliary/gather/ibm_bigfix_sites_packages_enumhttp://www.securityfocus.com/bid/107189