CVE-2013-3998: Code Injection
Published Mar 26, 2014
·Updated
CRLF injection vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Affected Software
10 affected components
IBM Infosphere BigInsights=1.1.0.0
IBM Infosphere BigInsights=1.1.0.1
IBM Infosphere BigInsights=1.1.0.2
IBM Infosphere BigInsights=1.2.0.0
IBM Infosphere BigInsights=1.3.0.0
IBM Infosphere BigInsights=1.3.0.1
IBM Infosphere BigInsights=1.4.0.0
IBM Infosphere BigInsights=2.0.0.0
IBM Infosphere BigInsights=2.1.0.0
IBM Infosphere BigInsights=2.1.0.1
Event History
Mar 26, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·10:55 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-3998?
CVE-2013-3998 has a moderate severity level as it allows HTTP response splitting attacks.
2
How do I fix CVE-2013-3998?
To fix CVE-2013-3998, update IBM InfoSphere BigInsights to version 2.1 FP2 or later.
3
Who is affected by CVE-2013-3998?
Authenticated users of IBM InfoSphere BigInsights versions prior to 2.1 FP2 are affected by CVE-2013-3998.
4
What types of attacks can CVE-2013-3998 lead to?
CVE-2013-3998 can lead to HTTP response splitting attacks, which may allow the injection of arbitrary HTTP headers.
5
What versions of IBM InfoSphere BigInsights are vulnerable to CVE-2013-3998?
IBM InfoSphere BigInsights versions 1.1, 1.2, 1.3, and 2.0 are vulnerable to CVE-2013-3998.