CVE-2013-3993VulnerabilityPublished 05/25/2022Updated 10/24/2026

CVE-2013-3993: IBM InfoSphere BigInsights Invalid Input Vulnerability

Affects IBM InfoSphere BigInsightsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/25/2022
KEV deadline: 06/15/2022
Ransomware: Used in ransomware campaigns
EPSS: 4.8% chance of exploitation in 30 days – higher than 91% of CVEs

What to do

CISA required action

The impacted product is end-of-life and should be disconnected if still in use.

nvd.nist.gov/vuln/detail/CVE-2013-3993 (opens in a new tab)

Description

CVE-2013-3993 is a vulnerability in IBM InfoSphere BigInsights where certain APIs accept invalid input, potentially allowing attackers unauthorized access to read, write, modify, or delete data. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided.

Summary

IBM InfoSphere BigInsights contains a vulnerability identified as CVE-2013-3993, where certain APIs improperly handle invalid input. This flaw can enable attackers to gain unauthorized access to data operations including reading, writing, modifying, or deleting data. The vulnerability is classified under CWE-264 (Permissions, Privileges, and Access Controls). It has been exploited in the wild and associated with ransomware campaigns. No vendor advisory or patch information is available in the provided data.

Impact

Successful exploitation of this vulnerability can lead to unauthorized data access and manipulation, including reading, writing, modifying, or deleting data within IBM InfoSphere BigInsights. This can compromise data integrity and confidentiality, and has been leveraged in ransomware attacks, indicating a high risk to affected environments.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Given the known exploitation in the wild and ransomware use, organizations should monitor IBM advisories for updates and apply any official fixes once available. Until then, restrict access to vulnerable APIs and implement compensating controls as feasible.

Weaknesses

CWE-264Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:49:29 UTC

Weaknesses

References

Related threats