Vulnerability-Lookup

CVE-2024-22319 (GCVE-0-2024-22319)

Vulnerability from cvelistv5 – Published: 2024-02-02 02:14 – Updated: 2024-08-01 22:43

KEVintel KEV

Title

IBM Operational Decision Manager JDNI injection

Summary

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

ibm

References

2 references

URL	Tags
https://www.ibm.com/support/pages/node/7112382	vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entry

Impacted products

8 products

Vendor	Product	Version
IBM	Operational Decision Manager	Affected: 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1
ibm	operational_decision_manager	Affected: 8.10.3 cpe:2.3:a:ibm:operational_decision_manager:8.10.3:::::::*
ibm	operational_decision_manager	Affected: 8.10.4 cpe:2.3:a:ibm:operational_decision_manager:8.10.4:::::::*
ibm	operational_decision_manager	Affected: 8.10.5.1 cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:::::::*
ibm	operational_decision_manager	Affected: 8.11 cpe:2.3:a:ibm:operational_decision_manager:8.11:::::::*
ibm	operational_decision_manager	Affected: 8.11.0.1 cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:::::::*
ibm	operational_decision_manager	Affected: 8.11.1 cpe:2.3:a:ibm:operational_decision_manager:8.11.1:::::::*
ibm	operational_decision_manager	Affected: 8.12.0.1 cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:::::::*

KEVintel KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 078b726c-7ae5-41cb-bc3d-79064fefa6d1

Vulnerability ID: CVE-2024-22319

Status: Confirmed

Status Updated: 2025-06-26 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2025-06-26

Asserted: 2025-06-26

Scope

Notes: KEVIntel entry: IBM Operational Decision Manager JDNI injection | Affected: IBM / Operational Decision Manager | CVSS: 8.1 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	IBM Operational Decision Manager JDNI injection
Vendor	IBM
Product	Operational Decision Manager
Added Date	2025-06-26T00:00:00.000Z
Cvss Score	8.1
Epss Score	None
Cvss Severity	HIGH
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-06-19 12:46 UTC | Updated: 2026-06-19 12:46 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.10.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.10.4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.10.5.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.11"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.11.0.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.11.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.11.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.12.0.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22319",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-24T05:00:22.740630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T15:00:34.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/7112382"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Operational Decision Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(248, 248, 248);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-29T18:55:52.839Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7112382"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Operational Decision Manager JDNI injection",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-22319",
    "datePublished": "2024-02-02T02:14:50.571Z",
    "dateReserved": "2024-01-08T23:41:52.508Z",
    "dateUpdated": "2024-08-01T22:43:34.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-22319",
      "date": "2026-06-19",
      "epss": "0.764",
      "percentile": "0.99478"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF279017-9ADC-4249-9956-BF63FD9EBD30\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"48771A1F-9BCC-44E2-A34C-F5A7F2D73E64\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"354E0F39-CA38-4A27-973B-7415C7A40FC2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"60B60CD2-D71D-43FE-B9AD-A11FE5FC132E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"\\n\\n\\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\\n\\n\\n\\n\"}, {\"lang\": \"es\", \"value\": \"IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\\u00eda permitir a un atacante remoto realizar una inyecci\\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145.\"}]",
      "id": "CVE-2024-22319",
      "lastModified": "2024-11-21T08:56:03.247",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@us.ibm.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-02-02T03:15:10.573",
      "references": "[{\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"VDB Entry\", \"Vendor Advisory\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"VDB Entry\", \"Vendor Advisory\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"psirt@us.ibm.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-74\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22319\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2024-02-02T03:15:10.573\",\"lastModified\":\"2024-11-21T08:56:03.247\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\n\\n\\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\\n\\n\\n\\n\"},{\"lang\":\"es\",\"value\":\"IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\u00eda permitir a un atacante remoto realizar una inyecci\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF279017-9ADC-4249-9956-BF63FD9EBD30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48771A1F-9BCC-44E2-A34C-F5A7F2D73E64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"354E0F39-CA38-4A27-973B-7415C7A40FC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60B60CD2-D71D-43FE-B9AD-A11FE5FC132E\"}]}]}],\"references\":[{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7112382\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7112382\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:43:34.602Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-22319\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-24T05:00:22.740630Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.3\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.4\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.5.1\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.11\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.11.0.1\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.11.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.11.1\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.12.0.1\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-28T15:00:00.604Z\"}}], \"cna\": {\"title\": \"IBM Operational Decision Manager JDNI injection\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"IBM\", \"product\": \"Operational Decision Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"tags\": [\"vdb-entry\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"\\n\\n\\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\\n\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\\n\\n\u003cspan style=\\\"background-color: rgb(248, 248, 248);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\u003c/span\u003e\\n\\n\u003c/span\u003e\\n\\n\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-74\", \"description\": \"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2024-02-29T18:55:52.839Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-22319\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T22:43:34.602Z\", \"dateReserved\": \"2024-01-08T23:41:52.508Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2024-02-02T02:14:50.571Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-22319

Vulnerability from fkie_nvd - Published: 2024-02-02 03:15 - Updated: 2026-06-17 07:11

KEVintel KEV

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/279145	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7112382	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/279145	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/7112382	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	operational_decision_manager	8.10.3
ibm	operational_decision_manager	8.10.4
ibm	operational_decision_manager	8.10.5.1
ibm	operational_decision_manager	8.11
ibm	operational_decision_manager	8.11.0.1
ibm	operational_decision_manager	8.12.0.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Operational Decision Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.3"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.4"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.5.1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.11"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.11.0.1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.11.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.11.1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.12.0.1"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF279017-9ADC-4249-9956-BF63FD9EBD30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "48771A1F-9BCC-44E2-A34C-F5A7F2D73E64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "354E0F39-CA38-4A27-973B-7415C7A40FC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "60B60CD2-D71D-43FE-B9AD-A11FE5FC132E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\u00eda permitir a un atacante remoto realizar una inyecci\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145."
    }
  ],
  "id": "CVE-2024-22319",
  "lastModified": "2026-06-17T07:11:10.703",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22319",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-02-24T05:00:22.740630Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-02-02T03:15:10.573",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7112382"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7112382"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-X4HH-7HPG-JMCG

Vulnerability from github – Published: 2024-02-02 03:30 – Updated: 2024-02-02 03:30

Details

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote attacker to conduct an LDAP injection. By sending a request with a specially crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter. IBM X-Force ID: 279145.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-22319"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-90"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-02T03:15:10Z",
    "severity": "HIGH"
  },
  "details": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote attacker to conduct an LDAP injection. By sending a request with a specially crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter.  IBM X-Force ID:  279145.",
  "id": "GHSA-x4hh-7hpg-jmcg",
  "modified": "2024-02-02T03:30:32Z",
  "published": "2024-02-02T03:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22319"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7112382"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-22319

Vulnerability from gsd - Updated: 2024-01-09 06:02

Details

Aliases

CVE-2024-22319

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-22319"
      ],
      "details": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote attacker to conduct an LDAP injection. By sending a request with a specially crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter.  IBM X-Force ID:  279145.",
      "id": "GSD-2024-22319",
      "modified": "2024-01-09T06:02:15.297570Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@us.ibm.com",
        "ID": "CVE-2024-22319",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Operational Decision Manager",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "IBM"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-74",
                "lang": "eng",
                "value": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.ibm.com/support/pages/node/7112382",
            "refsource": "MISC",
            "url": "https://www.ibm.com/support/pages/node/7112382"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CF279017-9ADC-4249-9956-BF63FD9EBD30",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "48771A1F-9BCC-44E2-A34C-F5A7F2D73E64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "354E0F39-CA38-4A27-973B-7415C7A40FC2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "60B60CD2-D71D-43FE-B9AD-A11FE5FC132E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
          },
          {
            "lang": "es",
            "value": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\u00eda permitir a un atacante remoto realizar una inyecci\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145."
          }
        ],
        "id": "CVE-2024-22319",
        "lastModified": "2024-03-21T02:52:02.483",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "psirt@us.ibm.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-02T03:15:10.573",
        "references": [
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "VDB Entry",
              "Vendor Advisory"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
          },
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.ibm.com/support/pages/node/7112382"
          }
        ],
        "sourceIdentifier": "psirt@us.ibm.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-74"
              }
            ],
            "source": "psirt@us.ibm.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-0241

Vulnerability from csaf_certbund - Published: 2024-01-29 23:00 - Updated: 2024-01-29 23:00

Summary

IBM Operational Decision Manager: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: IBM Operational Decision Manager ist Software für die Integration von Geschäftsereignissen und Geschäftsregeln, um Entscheidungen über verschiedene Prozesse und Anwendungen hinweg zu automatisieren.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Operational Decision Manager ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Programmcode mit Administratorrechten auszuführen, Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2023-34055

Es bestehen mehrere Schwachstellen in IBM Operational Decision Manager. Diese Fehler bestehen in den Komponenten des Drittanbieters VMware Tanzu Reactor Netty und Spring Boot. Durch das Senden speziell gestalteter HTTP-Anforderungen kann ein entfernter Angreifer diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.

CVE-2023-34054

CVE-2023-34062

Es besteht eine Schwachstelle in IBM Operational Decision Manager. Dieser Fehler besteht in der VMware Tanzu Reactor Netty-Komponente eines Drittanbieters aufgrund einer unsachgemäßen Validierung von Benutzeranfragen. Durch Senden einer speziell gestalteten URL-Anfrage, die "Punkt-Punkt"-Sequenzen (/../) enthält, kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um beliebige Dateien auf dem System anzuzeigen und so vertrauliche Informationen offenzulegen.

CVE-2024-22319

Es besteht eine Schwachstelle in IBM Operational Decision Manager. Dieser Fehler besteht aufgrund einer unsachgemäßen Neutralisierung von Benutzereingaben, die eine LDAP-Injektion ermöglicht. Durch das Senden einer Anfrage mit einer speziell gestalteten Anfrage kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um nicht bereinigte Inhalte in den LDAP-Filter zu injizieren.

CVE-2024-22320

Es besteht eine Schwachstelle in IBM Operational Decision Manager. Dieser Fehler besteht aufgrund einer unsicheren Deserialisierung. Durch das Senden speziell gestalteter Anfragen kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um beliebigen Code im Kontext von SYSTEM auszuführen.

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.ibm.com/support/pages/node/7112382	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM Operational Decision Manager ist Software f\u00fcr die Integration von Gesch\u00e4ftsereignissen und Gesch\u00e4ftsregeln, um Entscheidungen \u00fcber verschiedene Prozesse und Anwendungen hinweg zu automatisieren.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Operational Decision Manager ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0241 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0241.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0241 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0241"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2024-01-29",
        "url": "https://www.ibm.com/support/pages/node/7112382"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM Operational Decision Manager: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-01-29T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:04:37.600+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-0241",
      "initial_release_date": "2024-01-29T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-01-29T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IBM Operational Decision Manager \u003c 8.10.5.1: Interim fix 051",
                "product": {
                  "name": "IBM Operational Decision Manager \u003c 8.10.5.1: Interim fix 051",
                  "product_id": "T032403",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:8.10.5.1_interim_fix_051"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Operational Decision Manager \u003c 8.11.0.1: Interim fix 027",
                "product": {
                  "name": "IBM Operational Decision Manager \u003c 8.11.0.1: Interim fix 027",
                  "product_id": "T032404",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:8.11.0.1_interim_fix_027"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Operational Decision Manager \u003c 8.11.1: Interim fix 019",
                "product": {
                  "name": "IBM Operational Decision Manager \u003c 8.11.1: Interim fix 019",
                  "product_id": "T032405",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:8.11.1_interim_fix_019"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Operational Decision Manager \u003c 8.12.0.1: Interim fix 001",
                "product": {
                  "name": "IBM Operational Decision Manager \u003c 8.12.0.1: Interim fix 001",
                  "product_id": "T032406",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:8.12.0.1_interim_fix_001"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Operational Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-34055",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in IBM Operational Decision Manager. Diese Fehler bestehen in den Komponenten des Drittanbieters VMware Tanzu Reactor Netty und Spring Boot. Durch das Senden speziell gestalteter HTTP-Anforderungen kann ein entfernter Angreifer diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen."
        }
      ],
      "release_date": "2024-01-29T23:00:00.000+00:00",
      "title": "CVE-2023-34055"
    },
    {
      "cve": "CVE-2023-34054",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in IBM Operational Decision Manager. Diese Fehler bestehen in den Komponenten des Drittanbieters VMware Tanzu Reactor Netty und Spring Boot. Durch das Senden speziell gestalteter HTTP-Anforderungen kann ein entfernter Angreifer diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen."
        }
      ],
      "release_date": "2024-01-29T23:00:00.000+00:00",
      "title": "CVE-2023-34054"
    },
    {
      "cve": "CVE-2023-34062",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in IBM Operational Decision Manager. Dieser Fehler besteht in der VMware Tanzu Reactor Netty-Komponente eines Drittanbieters aufgrund einer unsachgem\u00e4\u00dfen Validierung von Benutzeranfragen. Durch Senden einer speziell gestalteten URL-Anfrage, die \"Punkt-Punkt\"-Sequenzen (/../) enth\u00e4lt, kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um beliebige Dateien auf dem System anzuzeigen und so vertrauliche Informationen offenzulegen."
        }
      ],
      "release_date": "2024-01-29T23:00:00.000+00:00",
      "title": "CVE-2023-34062"
    },
    {
      "cve": "CVE-2024-22319",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in IBM Operational Decision Manager. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Neutralisierung von Benutzereingaben, die eine LDAP-Injektion erm\u00f6glicht. Durch das Senden einer Anfrage mit einer speziell gestalteten Anfrage kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um nicht bereinigte Inhalte in den LDAP-Filter zu injizieren."
        }
      ],
      "release_date": "2024-01-29T23:00:00.000+00:00",
      "title": "CVE-2024-22319"
    },
    {
      "cve": "CVE-2024-22320",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in IBM Operational Decision Manager. Dieser Fehler besteht aufgrund einer unsicheren Deserialisierung. Durch das Senden speziell gestalteter Anfragen kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um beliebigen Code im Kontext von SYSTEM auszuf\u00fchren."
        }
      ],
      "release_date": "2024-01-29T23:00:00.000+00:00",
      "title": "CVE-2024-22320"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-22319 (GCVE-0-2024-22319)

KEVintel KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

FKIE_CVE-2024-22319

GHSA-X4HH-7HPG-JMCG

GSD-2024-22319

WID-SEC-W-2024-0241

Tags

Sightings

Nomenclature