{"id":"CVE-2013-3993","kind":"vulnerability","aliases":["CVE-2013-3993"],"related":[],"title":"IBM InfoSphere BigInsights: IBM InfoSphere BigInsights Invalid Input Vulnerability","description":"Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.\n\nCISA required action: The impacted product is end-of-life and should be disconnected if still in use.","summary":"IBM InfoSphere BigInsights has an invalid-input flaw in certain APIs that can let an attacker read, write, modify, or delete data without authorization. CISA lists it in the Known Exploited Vulnerabilities catalog and notes the product is end-of-life.","severity":"medium","cvss":6.5,"epss":0.04766,"exploited":true,"exploited_at":"2022-05-25T00:00:00+00:00","products":[{"name":"IBM InfoSphere BigInsights","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","hadoop","ibm","infosphere-biginsights","ransomware","self-hosted","vendor"],"not_affected_if":["not-installed"],"how_to_check":"Check whether IBM InfoSphere BigInsights is installed or reachable on your network; the sources do not give a command or file path.","fix":"Disconnect the product if it is still in use, as CISA requires, since it is end-of-life and no vendor fix is named in the sources.","status":"open","published_at":"2014-07-07T11:01:28+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:43+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:15:43Z","model":"claude-haiku-5-5","output":{"fix":"Disconnect the product if it is still in use, as CISA requires, since it is end-of-life and no vendor fix is named in the sources.\nunknown","reach":"unknown","impact":"high","summary":"IBM InfoSphere BigInsights has an invalid-input flaw in certain APIs that can let an attacker read, write, modify, or delete data without authorization. CISA lists it in the Known Exploited Vulnerabilities catalog and notes the product is end-of-life.","category":"vendor","who_cares":["ibm","infosphere-biginsights","hadoop","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads, modifies, or deletes data through vulnerable APIs without authorization","analyst_note":"Find affected versions, the vulnerable API names, and whether a vendor fix or mitigation exists via the IBM security bulletin for CVE-2013-3993 and the CISA KEV entry.","how_to_check":"Check whether IBM InfoSphere BigInsights is installed or reachable on your network; the sources do not give a command or file path.\nunknown","needs_analyst":true,"not_affected_if":["not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00051,"input_tokens":2853,"output_tokens":449,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2013':11A,14A '-3993':12A,15A 'access':86C 'action':96C 'allow':83C 'api':41B,74C 'attack':46B,84C 'author':54B 'biginsight':3A,6A,24B,32B,76C 'biginsights':18A 'catalog':63B 'certain':40B,73C 'cisa':55B,94C 'cve':10A,13A 'data':52B,93C 'delet':51B,92C 'disconnect':108C 'end':70B,102C 'end-of-lif':69B,101C 'exploit':19B,61B 'flaw':38B 'hadoop':20B 'host':28B 'ibm':1A,4A,16A,21B,30B 'impact':98C 'infospher':2A,5A,23B,31B 'infosphere':17A 'infosphere-biginsight':22B 'input':8A,37B,80C 'invalid':7A,36B,79C 'invalid-input':35B 'known':60B 'let':44B 'life':72B,104C 'list':56B 'might':82C 'modifi':49B,90C 'note':65B 'product':67B,99C 'ransomwar':25B 'read':47B,88C 'requir':95C 'self':27B 'self-host':26B 'still':110C 'take':78C 'unauthor':85C 'use':112C 'vendor':29B 'vulner':9A,62B 'within':75C 'without':53B 'write':48B,89C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-07-07T11:01:28+00:00","kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-3993","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-3993","severity":null,"published_at":"2022-05-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2013-3993","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3993","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-3993","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3993","severity":null,"published_at":"2014-07-07T11:01:28+00:00","modified_at":"2026-06-16T23:56:08+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}