by Kastro
Paper/Archive/CVE-2024-22319

CVE-2024-22319

IBM Operational Decision Manager — IBM Operational Decision Manager JDNI injection

EPSS 76%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.5.995 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

Affected

ProductAffectedFixed inSource
Operational Decision Manager8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1–CNA
operational_decision_manager8.10.3–CISA-ADP
operational_decision_manager8.10.4–CISA-ADP
operational_decision_manager8.10.5.1–CISA-ADP
operational_decision_manager8.11–CISA-ADP
operational_decision_manager8.11.0.1–CISA-ADP
operational_decision_manager8.11.1–CISA-ADP
operational_decision_manager8.12.0.1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisoryibm.com/support/pages/node/7112382refexchange.xforce.ibmcloud.com/vulnerabilities/279145