Vulnerability Details CVE-2024-22320
IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.922
EPSS Ranking 99.7%
CVSS Severity
CVSS v3 Score 9.8
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/279146
- https://www.ibm.com/support/pages/node/7112382
- https://exchange.xforce.ibmcloud.com/vulnerabilities/279146
- https://www.ibm.com/support/pages/node/7112382
- https://www.vicarius.io/vsociety/posts/unveiling-cve-2024-22320-a-novices-journey-to-exploiting-java-deserialization-rce-in-ibm-odm
Products affected by CVE-2024-22320
-
cpe:2.3:a:ibm:operational_decision_manager:8.10.3
-
cpe:2.3:a:ibm:operational_decision_manager:8.10.4
-
cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1
-
cpe:2.3:a:ibm:operational_decision_manager:8.11
-
cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1
-
cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1