SB2026022019 - Multiple vulnerabilities in IBM Operational Decision Manager
Published: February 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Insufficient verification of data authenticity (CVE-ID: CVE-2024-45217)
The vulnerability allows a remote attacker to compromise the affected instance.
The vulnerability exists due to ConfigSets created during a backup restore command are trusted implicitly. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request.
2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-24814)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error when handling configuration files. Solr instances that use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.
3) Improper Authentication (CVE-ID: CVE-2024-45216)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in the PKIAuthenticationPlugin when handling URLs. A remote attacker can bypass authentication process using a fake URL ending at the end of any Solr API URL path and gain unauthorized access to the application.
4) Path traversal (CVE-ID: CVE-2024-52012)
The vulnerability allows a remote user to overwrite arbitrary files on the system.
The vulnerability exists due to input validation error when handling ZIP files passed via "configset upload" API. A remote user can upload a specially crafted ZIP archive and overwrite arbitrary files on the system (a.k.a. zipslip attack).
Remediation
Install update from vendor's website.