CVE-2013-3993
KEVRansomware UseIBM InfoSphere BigInsights Invalid Input Vulnerability
Description
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NPublishedJul 7, 2014
Last modifiedJun 16, 2026
Added to KEVMay 25, 2022
Remediation dueJun 15, 2022
References
- secunia.com/advisories/59676Broken Link
- www-01.ibm.com/support/docview.wss?uid=swg21677445Vendor Advisory
- securityfocus.com/bid/68449Broken LinkThird Party Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/84982Third Party AdvisoryVDB Entry
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3993US Government Resource
0 recent articles mention this CVE
73
Risk assessment · High
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1594 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 6.5 MEDIUM
- EPSS (30-day exploit probability)
- 4.8% · top 8% of all CVEs
- Weakness
- CWE-22
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.The impacted product is end-of-life and should be disconnected if still in use.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.