Description

IBM ODM allows an unauthenticated user to connect it to any LDAP server. An attacker can exploit it to achieve remote code execution.

Remediation

Upgrade to the latest version of IBM ODM

References

Security Bulletin: IBM Operational Decision Manager for January 2024 - Multiple CVEs addressed

To live is to fight, to fight is to live! - IBM ODM Remote Code Execution

Related Vulnerabilities

phpMyAdmin Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-18622)

XWiki CVE-2023-50720 Vulnerability (CVE-2023-50720)

Ampache Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-28852)

MySQL CVE-2019-2795 Vulnerability (CVE-2019-2795)

Django Improper Input Validation Vulnerability (CVE-2011-4139)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Known Vulnerabilities Code Execution Acumonitor CWE-74 CVE-2024-22319