A vulnerability was found in Oracle Agile PLM 9.3.4/9.3.5 (Product Lifecycle Management Software) and classified as critical. This issue affects an unknown functionality of the component SDK. The manipulation with an unknown input leads to a remote code execution vulnerability. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SDK.

The weakness was released 07/19/2016 with Oracle as Oracle Critical Patch Update Advisory - July 2016 as confirmed advisory (Website). It is possible to read the advisory at oracle.com. The identification of this vulnerability is CVE-2016-3561 since 03/17/2016. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 91787†). Entries connected to this vulnerability are available at VDB-76354, VDB-78584, VDB-78603 and VDB-78601. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Product Lifecycle Management Software

Vendor

• Oracle

Name

• Agile PLM

Version

• 9.3.4
• 9.3.5

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion