CVE-2024-22319: high-severity vulnerability in IBM Operational Decision Manager
IBM Operational Decision Manager JDNI injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
IBM Operational Decision Manager has a security flaw that allows attackers to run harmful code remotely by injecting malicious data through a specific API function that doesn't properly validate its inputs.
The vulnerability is a JNDI injection flaw in IBM Operational Decision Manager versions 8.10.3 through 8.12.0.1, where an unchecked API argument enables remote code execution. The attack vector requires network access to the vulnerable API endpoint; successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected application.
In the same product, most dangerous first.