CVE-2024-21287KEV · OVERDUE

Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

High · published November 18, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 77.3th percentile for exploit probability.

681
days past CISA
deadline
CVSS v3.1
7.5
EPSS
2%
Percentile
77.3
In the wild
Confirmed
What it is

🚨 An unauthenticated HTTP request is all it takes to compromise Oracle Agile PLM Framework! 🔥 Think of it like an unlocked rear door to a secure office building; anyone with network access can walk right in and access sensitive information without any checks. It's surprisingly simple to poke around where you shouldn't be! If exploited, an attacker can gain unauthorized access to critical data stored within the Oracle Agile PLM Framework, potentially leading to exposure of confidential information. This could have serious consequences, from data breaches to financial losses, making it vital to act swiftly!

Put simply

Think of it like an unlocked rear door to a secure office building; anyone with network access can walk right in and access sensitive information without any checks. It's surprisingly simple to poke around where you shouldn't be! This vulnerability allows unauthenticated attackers with network access to exploit weaknesses in the Oracle Agile PLM Framework, leading to unauthorized access to sensitive data.

What to do

If exploited, an attacker can gain unauthorized access to critical data stored within the Oracle Agile PLM Framework, potentially leading to exposure of confidential information. This could have serious consequences, from data breaches to financial losses, making it vital to act swiftly! Update to the latest version of Oracle Agile PLM Framework (9.3.7 or later) immediately to mitigate this risk. Additionally, consider implementing network security measures to restrict unauthorized access. Don't delay these fixes! You've got this! By taking action now, you can safeguard your data and maintain your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01723 · 77.3th percentile
Published
2024-11-18T21:39Z
KEV added
2024-11-21 · due 2024-12-12
EPSS history
Timeline
  • 21 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 12
    kev
  • 18 NOV 21:39Z
    Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension)
    cvelistv5