Read the docs
TI-2024-14906 Aliases CVE-2024-22319GHSA-x4hh-7hpg-jmcg

IBM Operational Decision Manager JDNI injection

Priority CRITICAL 88CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.764 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMOperational Decision Manager8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1—No fix listedCNA
  • Operational Decision Manager VendorIBM Affected 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, 8.12.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*8.10.3VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*8.10.4VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*8.10.5.1VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*8.11VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*8.11.0.1VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*8.12.0.1VulnerableIBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:* Versions 8.10.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:* Versions 8.10.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:* Versions 8.10.5.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:* Versions 8.11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:* Versions 8.11.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:* Versions 8.12.0.1 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IBM Operational Decision Manager — ibm.com/support/pages/node/7112382

    2 records Highest priority Priority CRITICAL 2 CRITICAL

    Other records, highest priority first

    • TI-2024-14907 IBM Operational Decision Manager code executionPriority CRITICAL 87
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22319
  2. 2026-10-03 Alias added: GHSA-x4hh-7hpg-jmcg

References

Patch 1

  • TI-2024-14907 IBM Operational Decision Manager code execution CVSS 3.1CRITICAL 9.8
  • TI-2018-01604 XML external entity injection in IBM Operational Decision Management CVSS 3.0CRITICAL 9.1
  • TI-2025-02466 IBM Operational Decision Manager HTTP open redirect CVSS 3.1HIGH 7.4
  • TI-2014-00866 Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution… CVSS 2.0MEDIUM 6.0
  • TI-2025-01337 IBM Operational Decision Manager cross-site scripting CVSS 3.1MEDIUM 6.1
  • TI-2014-05042 The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere… CVSS 2.0MEDIUM 5.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences