CVE-2013-3993: IBM InfoSphere BigInsights path traversal via crafted API parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with known ransomware use, but exploitation requires authentication and the CVSS score is only 6.5.

What it is

IBM InfoSphere BigInsights before 2.1.0.3 fails to properly restrict file and directory access, allowing crafted parameters in unspecified API calls to bypass intended restrictions. The flaw is a path traversal (CWE-22) that can also expose untrusted data or code. It matters because the product is end-of-life and the issue is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who can authenticate can read files and directories outside the intended scope and reach untrusted data or code. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reachable over the network through unspecified API calls, requiring a low-privileged authenticated account and no user interaction. The exact endpoints and parameters are not described in the record.

Exploitation

CISA added it to KEV on 2022-05-25 with known ransomware campaign use, indicating exploitation in the wild. EPSS is 0.05236 (92nd percentile), a moderate 30-day probability relative to other CVEs.

What to do

• Upgrade to InfoSphere BigInsights 2.1.0.3 or later if the product is still supported; the record does not list a fixed build beyond that version.
• If the product is end-of-life, disconnect it from the network as CISA's required action states.
• Restrict network access to BigInsights APIs to trusted hosts and accounts, and remove or disable unused accounts.
• Validate and canonicalize file path parameters in any custom integration that calls these APIs.
• Monitor for and block traversal patterns such as ../ and encoded variants in API requests.

Detection

• Review BigInsights API logs for path parameters containing ../, ..\, or encoded traversal sequences.
• Alert on authenticated API calls that read files outside expected data directories.
• Hunt for unusual file access patterns by low-privileged accounts on BigInsights hosts.
• Correlate KEV-listed CVE exploitation indicators with ransomware precursor activity on the same network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.