Actively exploited · Published Nov 18, 2024 · Assigned by oracle

CVE-2024-21287

High 7.5 Exploited

In plain English

A high-severity incorrect authorization in Oracle Agile PLM Framework from Oracle Corporation. Attackers are actively exploiting it in the wild (listed by CISA on November 21, 2024). The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.7%top 22.4% of all CVEs

Exploited in the wildYesCISA KEV since Nov 21, 2024

Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Dec 12, 2024.

Official description

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected products (as reported)

Vendor	Product	Versions
Oracle Corporation	Oracle Agile PLM Framework	9.3.6

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Oracle Advisory vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21287 government-resource