Description

IBM ODM allows an unauthenticated user to connect it to any LDAP server. An attacker can exploit it to achieve remote code execution.

Remediation

Upgrade to the latest version of IBM ODM

References

Security Bulletin: IBM Operational Decision Manager for January 2024 - Multiple CVEs addressed

To live is to fight, to fight is to live! - IBM ODM Remote Code Execution

Related Vulnerabilities

MySQL CVE-2015-4757 Vulnerability (CVE-2015-4757)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-2509)

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-7983)

Magento Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-1397)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-1580)

Severity

Critical

Classification

CVE-2024-22319 CWE-74 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Known Vulnerabilities Code Execution Acumonitor