CVE-2024-22319CWE-74

IBM Operational Decision Manager JDNI injection

High · published February 2, 2024

Patch now

High probability of exploitation

CVSS calls it high at 8.1. It sits in the 99.5th percentile for exploit probability.

CVSS v3.1

8.1

EPSS

76%

Percentile

99.5

In the wild

Unconfirmed

What it is

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.76400 · 99.5th percentile
Weakness: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published: 2024-02-02T02:14Z

EPSS history

Timeline

02 FEB 02:14Z
IBM Operational Decision Manager JDNI injection
cvelistv5