CVE-2017-10039 in Agile PLM
Summary
by MITRE
Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Web Client). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified as CVE-2017-10039 resides within Oracle Agile PLM component of the Oracle Supply Chain Products Suite, specifically affecting the Web Client subcomponent. This security flaw impacts versions 9.3.5 and 9.3.6 of the software, representing a significant concern for organizations utilizing this product line. The vulnerability operates with a CVSS 3.0 base score of 6.8, classified as a medium to high severity issue that demonstrates the potential for substantial data compromise. The attack vector requires network access via HTTP, making it accessible to remote threat actors who can exploit this weakness without requiring physical access to the target systems.
The technical nature of this vulnerability stems from insufficient access controls within the Oracle Agile PLM Web Client implementation. The flaw allows a low privileged attacker to potentially gain unauthorized access to sensitive data within the system. While the vulnerability itself is contained within Oracle Agile PLM, the security implications extend beyond this single component as the attack can impact additional products within the broader Oracle Supply Chain Products Suite ecosystem. This cross-component impact represents a particularly concerning aspect of the vulnerability, as it suggests that exploitation of this flaw could potentially cascade into other systems within the organization's supply chain infrastructure.
The operational impact of successfully exploiting CVE-2017-10039 can be severe, potentially enabling attackers to achieve unauthorized access to critical data or even complete access to all data accessible through Oracle Agile PLM. This level of access could expose sensitive product information, manufacturing data, supply chain details, and other confidential business information that organizations rely upon for competitive advantage. The requirement for human interaction from a person other than the attacker indicates that social engineering or targeted phishing attacks may be necessary to initiate the exploitation process, but once triggered, the vulnerability can provide substantial access privileges to the attacker. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) confirms that while the attack requires low complexity and low privilege levels, it necessitates user interaction, making it particularly challenging to defend against through traditional network security measures alone.
Organizations affected by this vulnerability should prioritize immediate remediation through Oracle's official security patches and updates. The implementation of network segmentation and monitoring controls can help detect potential exploitation attempts, while regular security assessments should be conducted to identify similar vulnerabilities within the supply chain ecosystem. This vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant concern for organizations operating within regulated industries where data protection and compliance requirements are paramount. The attack pattern described in the MITRE ATT&CK framework would likely involve initial access through web-based exploitation followed by privilege escalation and data exfiltration activities, emphasizing the need for comprehensive incident response planning and network monitoring capabilities.