CVE-2024-22319

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
IBMOperational Decision Manager8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1
ibmoperational_decision_manager8.10.3
ibmoperational_decision_manager8.10.4
ibmoperational_decision_manager8.10.5.1
ibmoperational_decision_manager8.11
ibmoperational_decision_manager8.11.0.1
ibmoperational_decision_manager8.11.1
ibmoperational_decision_manager8.12.0.1

References

Timeline

Published
Feb 2, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-22328.1The lacks CSRF checks allowing a user to invite any user to any group (including private groups)CVE-2024-223208.8IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unCVE-2024-223266.3IBM System Storage DS8900F 89.22.19.0, 89.30.68.0, 89.32.40.0, 89.33.48.0, 89.40.83.0, and 89.40.93.0 could allow a remote user to create anCVE-2024-223287.5IBM Maximo Application Suite 8.10 and 8.11 could allow a remote attacker to traverse directories on the system. An attacker could send a speCVE-2024-223294.3IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-siCVE-2024-22334.3The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users performCVE-2024-223309.8IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackeCVE-2024-223315.5IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, 7.2 through 7.2.3.8, 7.3 through 7.3.2.3, and IBM UrbanCode Deploy (UCVE-2024-223326.5The IBM Integration Bus for z/OS 10.1 through 10.1.0.2 AdminAPI is vulnerable to a denial of service due to file system exhaustion. IBM X-FCVE-2024-223333.3IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read bCVE-2024-223344.4IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 tCVE-2024-223355.5IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive informat