Read the docs
TI-2024-14907 Aliases CVE-2024-22320GHSA-5pq5-cp3w-7chj

IBM Operational Decision Manager code execution

Priority CRITICAL 87CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.73398 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMOperational Decision Manager8.10.3—No fix listedCNA
  • Operational Decision Manager VendorIBM Affected 8.10.3 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*8.10.3VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*8.10.4VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*8.10.5.1VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*8.11VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*8.11.0.1VulnerableIBM
cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*8.12.0.1VulnerableIBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:* Versions 8.10.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:* Versions 8.10.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:* Versions 8.10.5.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:* Versions 8.11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:* Versions 8.11.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:* Versions 8.12.0.1 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IBM Operational Decision Manager — ibm.com/support/pages/node/7112382

    2 records Highest priority Priority CRITICAL 2 CRITICAL

    Other records, highest priority first

    • TI-2024-14906 IBM Operational Decision Manager JDNI injectionPriority CRITICAL 88
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22320
  2. 2026-10-03 Alias added: GHSA-5pq5-cp3w-7chj

References

Patch 1

  • TI-2024-14906 IBM Operational Decision Manager JDNI injection CVSS 3.1CRITICAL 9.8
  • TI-2018-01604 XML external entity injection in IBM Operational Decision Management CVSS 3.0CRITICAL 9.1
  • TI-2025-02466 IBM Operational Decision Manager HTTP open redirect CVSS 3.1HIGH 7.4
  • TI-2014-00866 Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution… CVSS 2.0MEDIUM 6.0
  • TI-2025-01337 IBM Operational Decision Manager cross-site scripting CVSS 3.1MEDIUM 6.1
  • TI-2014-05042 The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere… CVSS 2.0MEDIUM 5.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences