CVE-2013-3993mediumunder attackransomwareCWE-22

CVE-2013-3993

Published · Updated

Follow this CVE+ Monitor InfoSphere BigInsights

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.5epss 4.8%
from disclosure to weapon
Published on NVDJul 7
CISA KEV+2879d
Action required by CISAfederal deadline: 2022-06-15

The impacted product is end-of-life and should be disconnected if still in use.

In short

IBM InfoSphere BigInsights versions before 2.1.0.3 contain a vulnerability where authenticated users can bypass file and directory access controls through manipulated API parameters, potentially accessing sensitive data or executing untrusted code.

Technical detail

CWE-22 path traversal vulnerability in IBM InfoSphere BigInsights prior to 2.1.0.3 allows authenticated users to bypass intended access restrictions via crafted parameters in unspecified API calls, enabling unauthorized file/directory access and potential code execution. Attack requires valid authentication credentials and knowledge of vulnerable API endpoints.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a