CVE-2025-2824

IBM Operational Decision Manager HTTP open redirect

View on CVE.org
Published Aug 1, 2025 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

Remediation

Vendor Solution

IBM Operational Decision Manager V8.11.0.1 Interim fix 046 is available, see download document https://www.ibm.com/support/pages/node/7238508 . IBM Operational Decision Manager V8.11.1: Interim fix 044 is available, see download document https://www.ibm.com/support/pages/node/7237139 . IBM Operational Decision Manager V8.12.0.1: Interim fix 028 is available, see download document https://www.ibm.com/support/pages/node/7236479 . IBM Operational Decision Manager V9.0.0.1: Interim fix 011 is available, see download document https://www.ibm.com/support/pages/node/7230722 .  IBM Operational Decision Manager V9.5.0.0: Interim fix 002 is available, see download document https://www.ibm.com/support/pages/node/7233740

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-23389 IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Title IBM Operational Decision Manager HTTP open redirect
First Time appeared Ibm
Ibm operational Decision Manager
Weaknesses CWE-601
CPEs cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:9.5.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm operational Decision Manager
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Aug 1, 2025, 6:07 PM
Reserved
Mar 26, 2025, 3:42 PM

View source JSON

Updated
Aug 1, 2025, 6:07 PM

JSON

Status
Analyzed
Published
Aug 1, 2025, 6:15 PM
Modified
Jun 17, 2026, 9:07 AM

View source JSON

No data.

No data.