IBM Operational Decision Manager JDNI injection
80Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.1epss 76%
from disclosure to weapon
Published on NVDFeb 2
VulnCheck+44d
exploitation probability
76%top 1% of all CVEs
observed exploitation
yesVulnCheck
In short
IBM Operational Decision Manager has a security flaw that allows attackers to run harmful code remotely by injecting malicious data through a specific API function that doesn't properly validate its inputs.
Technical detail
The vulnerability is a JNDI injection flaw in IBM Operational Decision Manager versions 8.10.3 through 8.12.0.1, where an unchecked API argument enables remote code execution. The attack vector requires network access to the vulnerable API endpoint; successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected application.
Summary generated and translated by AI from the official description.
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
IBM · Operational Decision Manager