PT-2024-8694 · Oracle · Oracle Agile Plm Framework

Joel Snape + 1 · CVE-2024-21287 · Published 2024-11-18 · Updated 2026-06-13

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6

Description An incorrect authorization issue exists in the Oracle Agile PLM Framework of Oracle Supply Chain, specifically within the Software Development Kit Process Extension component. This flaw is caused by insufficient input validation and allows an unauthenticated remote attacker with network access via HTTP to bypass authentication. Successful exploitation enables the attacker to disclose protected information, access critical data, or download sensitive files from the system. This issue has been actively exploited in real-world attacks.

Recommendations Apply security patches for version 9.3.6 immediately.

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-20

CWE-863

Related Identifiers

BDU:2024-10296

CVE-2024-21287

Affected Products

Oracle Agile Plm Framework

References · 54

• https://nvd.nist.gov/vuln/detail/CVE-2024-21287 · Security Note
• https://bdu.fstec.ru/vul/2024-10296 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21287 · Vendor Advisory
• https://twitter.com/DMFezzaReed/status/1859281919227158679 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21287 · Note
• https://twitter.com/helpnetsecurity/status/1858835112051519831 · Twitter Post
• https://twitter.com/pravin_karthik/status/1859594871168012548 · Twitter Post
• https://twitter.com/OstorlabSec/status/1860000862090723830 · Twitter Post
• https://twitter.com/s_adachi/status/1859345146078458218 · Twitter Post
• https://twitter.com/dailycve/status/1862213397229568043 · Twitter Post
• https://twitter.com/DMFezzaReed/status/1859635694722785386 · Twitter Post
• https://twitter.com/Eth1calHackrZ/status/1883639804199628887 · Twitter Post
• https://twitter.com/securityRSS/status/1859228734064062592 · Twitter Post
• https://twitter.com/LimitedViewX/status/1877757046432366686 · Twitter Post
• https://t.me/cvedetector/11407 · Telegram Post