Vulnerability-Lookup

CVE-2024-22319 (GCVE-0-2024-22319)

Vulnerability from cvelistv5 – Published: 2024-02-02 02:14 – Updated: 2024-08-01 22:43

Shadowserver Previdian

Title

IBM Operational Decision Manager JDNI injection

Summary

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-24 05:00 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

ibm mitre root

References

2 references

URL	Tags
https://www.ibm.com/support/pages/node/7112382	vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entry

Impacted products

8 products

Vendor	Product	Version	CPE status
IBM	Operational Decision Manager	Affected: 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1	guessed
ibm	operational_decision_manager	Affected: 8.10.3 cpe:2.3:a:ibm:operational_decision_manager:8.10.3:::::::*
ibm	operational_decision_manager	Affected: 8.10.4 cpe:2.3:a:ibm:operational_decision_manager:8.10.4:::::::*
ibm	operational_decision_manager	Affected: 8.10.5.1 cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:::::::*
ibm	operational_decision_manager	Affected: 8.11 cpe:2.3:a:ibm:operational_decision_manager:8.11:::::::*
ibm	operational_decision_manager	Affected: 8.11.0.1 cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:::::::*
ibm	operational_decision_manager	Affected: 8.11.1 cpe:2.3:a:ibm:operational_decision_manager:8.11.1:::::::*
ibm	operational_decision_manager	Affected: 8.12.0.1 cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:::::::*

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: e620a590-520f-4d3b-a72a-9c7d96e511a9

Vulnerability ID: CVE-2024-22319

Status: Confirmed

Status Updated: 2026-07-19 00:00 UTC

Exploited: Yes

Characteristics

Severity: 98.0

Timestamps

First Seen: 2024-03-17

Asserted: 2024-03-17

Last Seen: 2026-07-19

Scope

Asset Exposure: ['internet-facing']

Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details

1D	1
Iot	no
Feed	Shadowserver Foundation honeypot/exploited-vulnerabilities
Type	http-scan
Class	business-intelligence
7D Avg	0
Vendor	IBM
30D Avg	1
90D Avg	2
Product	IBM Operational Decision Manager
Cisa Kev	no
Connections	1
Observation Date	2026-07-19
Vulnerability Class	CVSS
Vulnerability Score	9.8
Vulnerability Severity	Critical

References

Created: 2026-06-30 09:23 UTC | Updated: 2026-07-21 01:01 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 185a9274-271b-4fa5-be44-59137020a8ec

Vulnerability ID: CVE-2024-22319

Status: Confirmed

Status Updated: 2025-06-26 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2025-06-26

Asserted: 2025-06-26

Scope

Notes: KEVIntel entry: IBM Operational Decision Manager JDNI injection | Affected: IBM / Operational Decision Manager | CVSS: 8.1 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	IBM Operational Decision Manager JDNI injection
Vendor	IBM
Product	Operational Decision Manager
Added Date	2025-06-26T00:00:00.000Z
Cvss Score	8.1
Epss Score	None
Cvss Severity	HIGH
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-06-23 14:03 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.10.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.10.4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.10.5.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.11"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.11.0.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.11.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.11.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "operational_decision_manager",
            "vendor": "ibm",
            "versions": [
              {
                "status": "affected",
                "version": "8.12.0.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22319",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-24T05:00:22.740630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T15:00:34.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/7112382"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Operational Decision Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(248, 248, 248);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-29T18:55:52.839Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7112382"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Operational Decision Manager JDNI injection",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-22319",
    "datePublished": "2024-02-02T02:14:50.571Z",
    "dateReserved": "2024-01-08T23:41:52.508Z",
    "dateUpdated": "2024-08-01T22:43:34.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-22319",
      "date": "2026-09-15",
      "epss": "0.764",
      "percentile": "0.9951"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF279017-9ADC-4249-9956-BF63FD9EBD30\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"48771A1F-9BCC-44E2-A34C-F5A7F2D73E64\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"354E0F39-CA38-4A27-973B-7415C7A40FC2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"60B60CD2-D71D-43FE-B9AD-A11FE5FC132E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"\\n\\n\\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\\n\\n\\n\\n\"}, {\"lang\": \"es\", \"value\": \"IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\\u00eda permitir a un atacante remoto realizar una inyecci\\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145.\"}]",
      "id": "CVE-2024-22319",
      "lastModified": "2024-11-21T08:56:03.247",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@us.ibm.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-02-02T03:15:10.573",
      "references": "[{\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"VDB Entry\", \"Vendor Advisory\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"VDB Entry\", \"Vendor Advisory\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"psirt@us.ibm.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-74\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22319\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2024-02-02T03:15:10.573\",\"lastModified\":\"2026-06-17T07:11:10.703\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\n\\n\\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\\n\\n\\n\\n\"},{\"lang\":\"es\",\"value\":\"IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\u00eda permitir a un atacante remoto realizar una inyecci\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"Operational Decision Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"ibm\",\"product\":\"operational_decision_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8.10.3\",\"status\":\"affected\"}]},{\"vendor\":\"ibm\",\"product\":\"operational_decision_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8.10.4\",\"status\":\"affected\"}]},{\"vendor\":\"ibm\",\"product\":\"operational_decision_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8.10.5.1\",\"status\":\"affected\"}]},{\"vendor\":\"ibm\",\"product\":\"operational_decision_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8.11\",\"status\":\"affected\"}]},{\"vendor\":\"ibm\",\"product\":\"operational_decision_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8.11.0.1\",\"status\":\"affected\"}]},{\"vendor\":\"ibm\",\"product\":\"operational_decision_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:ibm:operational_decision_manager:8.11.1:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8.11.1\",\"status\":\"affected\"}]},{\"vendor\":\"ibm\",\"product\":\"operational_decision_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8.12.0.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-02-24T05:00:22.740630Z\",\"id\":\"CVE-2024-22319\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF279017-9ADC-4249-9956-BF63FD9EBD30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48771A1F-9BCC-44E2-A34C-F5A7F2D73E64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"354E0F39-CA38-4A27-973B-7415C7A40FC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60B60CD2-D71D-43FE-B9AD-A11FE5FC132E\"}]}]}],\"references\":[{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7112382\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7112382\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T18:55:06+00:00",
      "cve": "CVE-2024-22319",
      "id": "CVE-2024-22319",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "IBM Operational Decision Manager JDNI injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-22319.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:43:34.602Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-22319\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-24T05:00:22.740630Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.3\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.4\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.5.1\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.11\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.11.0.1\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.11.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.11.1\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*\"], \"vendor\": \"ibm\", \"product\": \"operational_decision_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.12.0.1\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-28T15:00:00.604Z\"}}], \"cna\": {\"title\": \"IBM Operational Decision Manager JDNI injection\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"IBM\", \"product\": \"Operational Decision Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7112382\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/279145\", \"tags\": [\"vdb-entry\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"\\n\\n\\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\\n\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\\n\\n\u003cspan style=\\\"background-color: rgb(248, 248, 248);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\u003c/span\u003e\\n\\n\u003c/span\u003e\\n\\n\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-74\", \"description\": \"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2024-02-29T18:55:52.839Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-22319\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T22:43:34.602Z\", \"dateReserved\": \"2024-01-08T23:41:52.508Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2024-02-02T02:14:50.571Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-22319

Vulnerability from fkie_nvd - Published: 2024-02-02 03:15 - Updated: 2026-06-17 07:11

Shadowserver Previdian

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/279145	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7112382	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/279145	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/7112382	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	operational_decision_manager	8.10.3
ibm	operational_decision_manager	8.10.4
ibm	operational_decision_manager	8.10.5.1
ibm	operational_decision_manager	8.11
ibm	operational_decision_manager	8.11.0.1
ibm	operational_decision_manager	8.12.0.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Operational Decision Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.3"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.4"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.10.5.1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.11"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.11.0.1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.11.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.11.1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "operational_decision_manager",
          "vendor": "ibm",
          "versions": [
            {
              "status": "affected",
              "version": "8.12.0.1"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF279017-9ADC-4249-9956-BF63FD9EBD30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "48771A1F-9BCC-44E2-A34C-F5A7F2D73E64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "354E0F39-CA38-4A27-973B-7415C7A40FC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "60B60CD2-D71D-43FE-B9AD-A11FE5FC132E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\u00eda permitir a un atacante remoto realizar una inyecci\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145."
    }
  ],
  "id": "CVE-2024-22319",
  "lastModified": "2026-06-17T07:11:10.703",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22319",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-02-24T05:00:22.740630Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-02-02T03:15:10.573",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7112382"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7112382"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-X4HH-7HPG-JMCG

Vulnerability from github – Published: 2024-02-02 03:30 – Updated: 2024-02-02 03:30

Details

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote attacker to conduct an LDAP injection. By sending a request with a specially crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter. IBM X-Force ID: 279145.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-22319"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-90"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-02T03:15:10Z",
    "severity": "HIGH"
  },
  "details": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote attacker to conduct an LDAP injection. By sending a request with a specially crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter.  IBM X-Force ID:  279145.",
  "id": "GHSA-x4hh-7hpg-jmcg",
  "modified": "2024-02-02T03:30:32Z",
  "published": "2024-02-02T03:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22319"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7112382"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-22319

Vulnerability from gsd - Updated: 2024-01-09 06:02

Details

Aliases

CVE-2024-22319

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-22319"
      ],
      "details": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote attacker to conduct an LDAP injection. By sending a request with a specially crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter.  IBM X-Force ID:  279145.",
      "id": "GSD-2024-22319",
      "modified": "2024-01-09T06:02:15.297570Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@us.ibm.com",
        "ID": "CVE-2024-22319",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Operational Decision Manager",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "IBM"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-74",
                "lang": "eng",
                "value": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.ibm.com/support/pages/node/7112382",
            "refsource": "MISC",
            "url": "https://www.ibm.com/support/pages/node/7112382"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CF279017-9ADC-4249-9956-BF63FD9EBD30",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "48771A1F-9BCC-44E2-A34C-F5A7F2D73E64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "354E0F39-CA38-4A27-973B-7415C7A40FC2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "60B60CD2-D71D-43FE-B9AD-A11FE5FC132E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "\n\n\nIBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.\n\n\n\n"
          },
          {
            "lang": "es",
            "value": "IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\u00eda permitir a un atacante remoto realizar una inyecci\u00f3n LDAP. Al enviar una solicitud especialmente manipulada, un atacante podr\u00eda aprovechar esta vulnerabilidad para inyectar contenido no sanitizado en el filtro LDAP. ID de IBM X-Force: 279145."
          }
        ],
        "id": "CVE-2024-22319",
        "lastModified": "2024-03-21T02:52:02.483",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "psirt@us.ibm.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-02T03:15:10.573",
        "references": [
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "VDB Entry",
              "Vendor Advisory"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279145"
          },
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.ibm.com/support/pages/node/7112382"
          }
        ],
        "sourceIdentifier": "psirt@us.ibm.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-74"
              }
            ],
            "source": "psirt@us.ibm.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-0241

Vulnerability from csaf_certbund - Published: 2024-01-29 23:00 - Updated: 2024-01-29 23:00

Summary

IBM Operational Decision Manager: Mehrere Schwachstellen

Severity

Hoch

Scope

5 vulnerabilities in this advisory, including CVE-2024-22319.

CVE-2024-22319

Es besteht eine Schwachstelle in IBM Operational Decision Manager. Dieser Fehler besteht aufgrund einer unsachgemäßen Neutralisierung von Benutzereingaben, die eine LDAP-Injektion ermöglicht. Durch das Senden einer Anfrage mit einer speziell gestalteten Anfrage kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um nicht bereinigte Inhalte in den LDAP-Filter zu injizieren.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-22319 (GCVE-0-2024-22319)

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Characteristics

Timestamps

Scope

Evidence

Honeypot In The Wild Attempts Confidence: 70% Source: shadowserver

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

FKIE_CVE-2024-22319

GHSA-X4HH-7HPG-JMCG

GSD-2024-22319

WID-SEC-W-2024-0241

Tags

Sightings

Nomenclature

Related by attack behaviour