CVE-2019-4061

MEDIUM EXPLOITED NUCLEI

IBM Bigfix Platform < 9.2.16 - Information Disclosure

Title source: rule

Description

IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associated sites due to not enabling authenticated access. IBM X-Force ID: 156869.

Exploits (1)

metasploit WORKING POC
by HD Moore, Chris Bellows, Ryan Hanson, Jacob Robles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ibm_bigfix_sites_packages_enum.rb

Nuclei Templates (1)

IBM BigFix Platform - Information Disclosure
MEDIUMVERIFIEDby daffainfo
Shodan: port:52311 "BigFixHTTPServer"

References (4)

Scores

CVSS v3 5.3
EPSS 0.8030
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

VulnCheck KEV 2024-04-08
CWE
CWE-200
Status published
Products (1)
ibm/bigfix_platform 9.2 - 9.2.16
Published Feb 27, 2019
Tracked Since Feb 18, 2026