Description

IBM ODM allows an unauthenticated user to connect it to any LDAP server. An attacker can exploit it to achieve remote code execution.

Remediation

Upgrade to the latest version of IBM ODM

References

Security Bulletin: IBM Operational Decision Manager for January 2024 - Multiple CVEs addressed

To live is to fight, to fight is to live! - IBM ODM Remote Code Execution

Related Vulnerabilities

MySQL CVE-2013-0389 Vulnerability (CVE-2013-0389)

TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-0815)

Claroline Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-3262)

MySQL CVE-2014-2432 Vulnerability (CVE-2014-2432)

Mailman Other Vulnerability (CVE-2006-2191)

Severity

Critical

Classification

CVE-2024-22319 CWE-74 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Known Vulnerabilities Code Execution Acumonitor