The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere ILOG JRules 7.1 before MP1 FP5 IF43; WebSphere Operational Decision Management 7.5 before FP3 IF41; and Operational Decision Manager 8.0 before MP1 FP2 IF34, 8.5 before MP1 FP1 IF43, and 8.6 before IF8 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:operational_decision_manager:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | IBM |
| cpe:2.3:a:ibm:operational_decision_manager:8.5:*:*:*:*:*:*:* | 8.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:operational_decision_manager:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | IBM |
| cpe:2.3:a:ibm:websphere_ilog_jrules:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:websphere_operational_decision_management:7.5:*:*:*:*:*:*:* | 7.5 | Vulnerable | IBM |
- cpe:2.3:a:ibm:operational_decision_manager:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·IBM
- cpe:2.3:a:ibm:operational_decision_manager:8.5:*:*:*:*:*:*:* Versions 8.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:operational_decision_manager:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·IBM
- cpe:2.3:a:ibm:websphere_ilog_jrules:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:websphere_operational_decision_management:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-6114
- 2026-10-03 Alias added: GHSA-73gm-6p92-7hc9
References
More IBM Operational Decision Manager vulnerabilities
- TI-2024-14906 IBM Operational Decision Manager JDNI injection CVSS 3.1CRITICAL 9.8
- TI-2024-14907 IBM Operational Decision Manager code execution CVSS 3.1CRITICAL 9.8
- TI-2018-01604 XML external entity injection in IBM Operational Decision Management CVSS 3.0CRITICAL 9.1
- TI-2025-02466 IBM Operational Decision Manager HTTP open redirect CVSS 3.1HIGH 7.4
- TI-2014-00866 Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution… CVSS 2.0MEDIUM 6.0
- TI-2025-01337 IBM Operational Decision Manager cross-site scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2014-6114 · CVE Program
- CVE-2014-6114 · NVD
- FIRST EPSS
- GHSA-73gm-6p92-7hc9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences