Vulnerability · Published Feb 2, 2024 · Assigned by ibm
CVE-2024-22320IBM Operational Decision Manager code execution
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Operational Decision Manager from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 73.4% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Operational Decision Manager | 8.10.3 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H