{"id":"CVE-2019-19100","aliases":["EUVD-2019-8737","GHSA-hcfw-8p6f-qf35"],"status":"published","title":"Privilege escalation via B\u0026R Automation Studio upgrade service","description":"A privilege escalation vulnerability in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.4SP, \u003c. 4.6.3SP, \u003c 4.7.2 and \u003c 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00274,"percentile":0.19876,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2020-04-29T02:09:21Z","modified":"2026-06-17T02:26:10Z","products":[{"vendor":"b\u0026r","product":"automation studio"},{"vendor":"b\u0026r industrial automation","product":"automation studio"},{"vendor":"br-automation","product":"automation_studio"}],"references":[{"url":"https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19100"},{"url":"https://github.com/advisories/GHSA-hcfw-8p6f-qf35"}],"sources":{"cve":[{"id":"CVE-2019-19100","title":"Privilege escalation via B\u0026R Automation Studio upgrade service","description":"A privilege escalation vulnerability in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.4SP, \u003c. 4.6.3SP, \u003c 4.7.2 and \u003c 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.","status":"published","published":"2020-04-29T02:09:21Z","modified":"2024-08-05T02:09:39.275Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-8737","description":"A privilege escalation vulnerability in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.4SP, \u003c. 4.6.3SP, \u003c 4.7.2 and \u003c 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.","status":"published","published":"2020-04-29T02:09:21Z","modified":"2024-08-05T02:09:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:26.287407Z"}],"ghsa":[{"id":"GHSA-hcfw-8p6f-qf35","title":"A privilege escalation vulnerability in the upgrade service in B\u0026R Automation Studio versions 4.0...","description":"A privilege escalation vulnerability in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.4SP, \u003c. 4.6.3SP, \u003c 4.7.2 and \u003c 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.","status":"published","published":"2022-05-24T17:16:49Z","modified":"2023-01-29T05:02:30Z","updated_at":"2026-11-02T14:45:06.209197Z"}],"nvd":[{"id":"CVE-2019-19100","description":"A privilege escalation vulnerability in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.4SP, \u003c. 4.6.3SP, \u003c 4.7.2 and \u003c 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.","status":"published","published":"2020-04-29T03:15:16.503Z","modified":"2026-06-17T02:26:10.08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:05:46.451008Z"}]}}