Vulnerability · Published Feb 2, 2024 · Assigned by ibm
CVE-2024-22319IBM Operational Decision Manager JDNI injection
High 8.1
In plain English
A high-severity injection in Operational Decision Manager from IBM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 76.4% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)76.4%top 0.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Operational Decision Manager | 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H