IBM InfoSphere BigInsights CVE-2013-3997 Open Redirection Vulnerability

Bugtraq ID:	66360
Class:	Input Validation Error
CVE:	CVE-2013-3997
Remote:	Yes
Local:	No
Published:	Mar 20 2014 12:00AM
Updated:	Mar 20 2014 12:00AM
Credit:	IBM
Vulnerable:	IBM InfoSphere BigInsights 2.1 IBM InfoSphere BigInsights 2.0 IBM InfoSphere BigInsights 1.4 IBM InfoSphere BigInsights 1.3 IBM InfoSphere BigInsights 1.2 IBM InfoSphere BigInsights 1.1.0.2 IBM InfoSphere BigInsights 1.1.0.1 IBM InfoSphere BigInsights 1.1.0.0 IBM InfoSphere BigInsights 1.1
Not Vulnerable:

IBM InfoSphere BigInsights CVE-2013-3997 Open Redirection Vulnerability

IBM InfoSphere BigInsights is prone to an open-redirection vulnerability because it fails to properly validate user-supplied input.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

IBM InfoSphere BigInsights 1.1 through 2.1 are vulnerable.

IBM InfoSphere BigInsights CVE-2013-3997 Open Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

IBM InfoSphere BigInsights CVE-2013-3997 Open Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM InfoSphere BigInsights CVE-2013-3997 Open Redirection Vulnerability

References:

• IBM Homepage (IBM)
  
• InfoSphere BigInsights Homepage (IBM)
  
• Security Bulletin: Multiple vulnerabilities in InfoSphere BigInsights (CVE-2013- (IBM)