CVE-2024-22320

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/279146	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/7112382	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:operational_decision_manager:8.10.3:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:8.10.4:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:8.11:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:::::::*

History

No history.

Information

Published : 2024-02-02 03:15

Updated : 2024-03-21 02:52

NVD link : CVE-2024-22320

Mitre link : CVE-2024-22320

CVE.ORG link : CVE-2024-22320

JSON object : View

Products Affected

ibm

operational_decision_manager

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2024-22320", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-02-02T03:15:10.780", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279146", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/7112382", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146."}, {"lang": "es", "value": "IBM Operational Decision Manager versiones 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1 y 8.12.0.1 podr\u00edan permitir que un atacante remoto autenticado ejecute c\u00f3digo arbitrario en el sistema, causado por una deserializaci\u00f3n insegura. Al enviar una solicitud especialmente manipulada, un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el contexto de SYSTEM. ID de IBM X-Force: 279146."}], "lastModified": "2024-03-21T02:52:02.607", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF279017-9ADC-4249-9956-BF63FD9EBD30"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48771A1F-9BCC-44E2-A34C-F5A7F2D73E64"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E64BDD7B-4A90-4026-A1F3-EEFE5D10DB62"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A246453D-AAB0-4BF0-AE62-CFCBAECC2C6E"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "354E0F39-CA38-4A27-973B-7415C7A40FC2"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60B60CD2-D71D-43FE-B9AD-A11FE5FC132E"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}