IBM · InfoSphere BigInsights
CVE-2013-3993
IBM InfoSphere BigInsights Invalid Input Vulnerability
What it is
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
CISA: Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
What to do
The impacted product is end-of-life and should be disconnected if still in use.
Deadline for US federal agencies: June 15, 2022
More exploited flaws from IBM
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 4, 2026 | Code Injection | Langflow | Critical 9.8 | 29% |
| Feb 21, 2023 | Code Execution | Aspera Faspex | Critical 9.8 | >99.9% |
| Jan 10, 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Critical 9.8 | 98% |
| Nov 3, 2021 | Remote Code Execution | Planning Analytics | Critical 10.0 | 86% |
| Nov 3, 2021 | Security Bypass | Data Risk Manager | Critical 9.0 | 70% |
| Nov 3, 2021 | Remote Code Execution | Data Risk Manager | Critical 9.1 | 62% |
| Nov 3, 2021 | Directory Traversal | Data Risk Manager | Medium 4.3 | 69% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.