Oracle Agile PLM Framework 9.3.6 Software Development Kit/Process Extension improper authorization

Summaryinfo

A vulnerability identified as critical has been detected in Oracle Agile PLM Framework 9.3.6. This impacts an unknown function of the component Software Development Kit/Process Extension. Performing a manipulation results in improper authorization. This vulnerability was named CVE-2024-21287. The attack may be initiated remotely. In addition, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Oracle Agile PLM Framework 9.3.6. It has been classified as critical. This affects some unknown functionality of the component Software Development Kit/Process Extension. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

It is possible to read the advisory at oracle.com. This vulnerability is uniquely identified as CVE-2024-21287 since 12/07/2023. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/19/2025). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 216480 (Oracle Agile Product Lifecycle Management (PLM) 9.3.6.x < 9.3.6.28.3 (CVE-2024-21287)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/21/2024 with a due date of 12/12/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (939) and Tenable (216480). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Product Lifecycle Management Software

Vendor

• Oracle

Name

• Agile PLM Framework

Version

• 9.3.6

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion