CVE-2019-4061

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associated sites due to not enabling authenticated access. IBM X-Force ID: 156869.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	BigFix Platform	9.2; 9.5

References

http://www.ibm.com/support/docview.wss?uid=ibm10870242Broken Link, Vendor Advisory
http://www.rapid7.com/db/modules/auxiliary/gather/ibm_bigfix_sites_packages_enumThird Party Advisory
http://www.securityfocus.com/bid/107189Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/156869VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10870242Broken Link, Vendor Advisory
http://www.rapid7.com/db/modules/auxiliary/gather/ibm_bigfix_sites_packages_enumThird Party Advisory
http://www.securityfocus.com/bid/107189Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/156869VDB Entry, Vendor Advisory

Timeline

Published: Feb 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-40627.1IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d CVE-2019-40635.9IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive information to be transmitted in plain tex CVE-2019-40668.8IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID CVE-2019-40677.5IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes CVE-2019-40687.5IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the CVE-2019-40698.8IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious CVE-2019-40705.4IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2019-40718.8IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute CVE-2019-40726.3IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the a CVE-2019-40735.4IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to e CVE-2019-40745.4IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to e CVE-2019-40755.4IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to e