CVE-2024-22319 IBM Operational Decision Manager JDNI injection
Remote attackers can execute arbitrary code via JNDI injection in IBM Operational Decision Manager due to unchecked API arguments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22319?
CVE-2024-22319 is a high-severity code injection vulnerability in IBM Operational Decision Manager, published on 2 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
Weakness: CWE-74
Which versions are affected by CVE-2024-22319?
It affects 1 product.
Products include Ibm Operational Decision Manager.
How do I fix CVE-2024-22319?
No fix has been published for CVE-2024-22319 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-22319 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22319 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in IBM Operational Decision Manager
- CVE-2024-22320 IBM Operational Decision Manager code execution
- CVE-2025-2824 IBM Operational Decision Manager HTTP open redirect
- CVE-2018-1821 XML external entity in Operational Decision Management
- CVE-2025-1551 IBM Operational Decision Manager cross-site scripting
- CVE-2014-0944 Cross-site request forgery in n/a
Sources
Also known as GHSA-x4hh-7hpg-jmcg.