Skip to content
OpenAdvisories
High WID-SEC-2024-0241 5 CVEs

IBM Operational Decision Manager: Mehrere Schwachstellen

Published Jan 29, 2024 · Updated Jan 29, 2024 · de-DE

Vendor: IBM Product: Operational Decision Manager Product: Operational Decision Manager < 8.10.5.1: Interim fix 051 Product: Operational Decision Manager < 8.11.0.1: Interim fix 027 Product: Operational Decision Manager < 8.11.1: Interim fix 019 Product: Operational Decision Manager < 8.12.0.1: Interim fix 001

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Operational Decision Manager ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Programmcode mit Administratorrechten auszuführen, Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

IBM Operational Decision Manager ist Software für die Integration von Geschäftsereignissen und Geschäftsregeln, um Entscheidungen über verschiedene Prozesse und Anwendungen hinweg zu automatisieren.

Vulnerabilities 5

  • Critical 9.8
    CVE-2024-22320 Scanner template EPSS 73%

    IBM Operational Decision Manager code execution

    IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arb…

    IBM Operational Decision Manager
  • High 8.1
    CVE-2024-22319 Scanner template EPSS 76%

    IBM Operational Decision Manager JDNI injection

    IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

    IBM Operational Decision Manager
  • High 7.5
    CVE-2023-34062

    In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack

    In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Rea…

    trino io.projectreactor.netty:reactor-netty-http Wolfi Maven
  • Medium 5.3
    CVE-2023-34054

    Reactor Netty HTTP Server Metrics DoS Vulnerability

    In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerabl…

    Spring Reactor Netty io.projectreactor.netty:reactor-netty-core Maven
  • Medium 5.3
    CVE-2023-34055

    Spring Boot server Web Observations DoS Vulnerability

    In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following…

    Spring Spring Boot org.springframework.boot:spring-boot-actuator Maven

Revision history

  1. #1

    Initiale Fassung

References