CVE-2013-3993 : IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to b

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.

Published 2014-07-07 11:01:28

Updated 2024-06-28 17:38:09

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2013-3993

IBM » Infosphere Biginsights
Versions before (<) 2.1.0.3
cpe:2.3:a:ibm:infosphere_biginsights:*:*:*:*:*:*:*:*
Matching versions

CVE-2013-3993 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

IBM InfoSphere BigInsights Invalid Input Vulnerability

CISA required action:

The impacted product is end-of-life and should be disconnected if still in use.

CISA description:

Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2013-3993

Added on 2022-05-25 Action due date 2022-06-15

Exploit prediction scoring system (EPSS) score for CVE-2013-3993

EPSS FAQ

9.87%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-3993

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
3.5	LOW	AV:N/AC:M/Au:S/C:P/I:N/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST	2024-06-28
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2013-3993

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)
CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-3993

http://secunia.com/advisories/59676

Sign in
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21677445

IBM Security Bulletin: Invalid input vulnerability in InfoSphere BigInsights (CVE-2013-3993)
Broken Link;Vendor Advisory
http://www.securityfocus.com/bid/68449

IBM InfoSphere BigInsights CVE-2013-3993 Unauthorized Access Security Bypass Vulnerability
Broken Link;Third Party Advisory;VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/84982

IBM InfoSphere BigInsights directory traversal CVE-2013-3993 Vulnerability Report
Third Party Advisory;VDB Entry