CVE-2024-22320

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22320
IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/279146 VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/7112382 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*
History

21 Mar 2024, 02:52

Type Values Removed Values Added
Summary (en) IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146. (en) IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.

06 Feb 2024, 19:54

Type Values Removed Values Added
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/279146 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/279146 - VDB Entry, Vendor Advisory
References () https://www.ibm.com/support/pages/node/7112382 - () https://www.ibm.com/support/pages/node/7112382 - Patch, Vendor Advisory
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*
Summary
  • (es) IBM Operational Decision Manager versiones 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podrían permitir que un atacante remoto autenticado ejecute código arbitrario en el sistema, causado por una deserialización insegura. Al enviar una solicitud especialmente manipulada, un atacante podría aprovechar esta vulnerabilidad para ejecutar código arbitrario en el contexto de SYSTEM. ID de IBM X-Force: 279146.
First Time Ibm
Ibm operational Decision Manager

02 Feb 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-02 03:15

Updated : 2024-03-21 02:52

NVD link : CVE-2024-22320

Mitre link : CVE-2024-22320

CVE.ORG link : CVE-2024-22320

JSON object : View

Products Affected

ibm

  • operational_decision_manager
CWE
CWE-502

Deserialization of Untrusted Data