Medium severity · published Jul 7, 2014
CVE-2013-3993
IBM InfoSphere BigInsights Invalid Input Vulnerability
RansomwareIn wildKEV
6.5
CVSS
4.8%
EPSS
Yes
On KEV
Description
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildYes
CISA KEVListed May 25, 2022
Federal remediation dueJun 15, 2022
Ransomware campaign useKnown
Affected products
Which versions
IB
Infosphere Biginsights · Ibm
before 2.1.0.3 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3993
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3993
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
third-party-advisory
http://secunia.com/advisories/59676
vdb-entry
http://www.securityfocus.com/bid/68449
vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/84982
x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=swg21677445
More from Infosphere Biginsights
7.4
CVE-2015-1947
Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privileges via a Trojan…
7.3
CVE-2015-1836
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect…
7.3
CVE-2015-1772
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products,…
6.5
CVE-2014-4782
IBM InfoSphere BigInsights 2.1.2 allows remote authenticated users to discover SMTP server credentials via vectors related to the Alert management service
5.4
CVE-2017-1554
IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim