[ CVE-2013-3993 · Published 7 Jul 2014 ]

IBM InfoSphere BigInsights Invalid Input Vulnerability

Exploited · CISA KEV CVSS 6.5 EPSS 5%No fix listed yet

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-25
Known to be used in ransomware campaigns

[ Description ]Official description

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.

CISA: Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Jun 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

secunia.com/advisories/59676Broken Link
www-01.ibm.com/support/docview.wssVendor Advisory
www.securityfocus.com/bid/68449Broken LinkThird Party AdvisoryVDB Entry
exchange.xforce.ibmcloud.com/vulnerabilities/84982Third Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource