The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
| Software | From | Fixed in |
|---|---|---|
| ibm / operational_decision_manager | 8.0 | 8.0.x |
| ibm / operational_decision_manager | 8.5 | 8.5.x |
| ibm / operational_decision_manager | 7.5 | 7.5.x |