CVE-2013-3993 IBM InfoSphere BigInsights Invalid Input

Exploited in the wild Medium 6.5 Published 7 Jul 2014 Updated 14 Aug 2026

Remote authenticated users can bypass file restrictions and access untrusted data or code via crafted API parameters in IBM InfoSphere BigInsights.

Exploited in the wild: Since 25 May 2022
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2013-3993?

CVE-2013-3993 is a medium-severity path traversal vulnerability in n/a, published on 7 Jul 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.

Weakness: CWE-22

Which versions are affected by CVE-2013-3993?

It affects 1 product.

Products include Ibm Infosphere Biginsights.

How do I fix CVE-2013-3993?

No fix has been published for CVE-2013-3993 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Jun 2022.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2013-3993 being exploited?

Yes. Attackers have exploited CVE-2013-3993 in the wild since at least 25 May 2022, including in ransomware campaigns.

Sources

Also known as GHSA-2qh2-hj3f-rhcf.