PT-2025-4286 · Oracle · Oracle Agile Plm Framework

Published 2025-01-21 · Updated 2025-01-21 · CVE-2025-21565

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM Framework version 9.3.6

Description The vulnerability in the Oracle Agile PLM Framework is related to weaknesses in the authorization mechanism of the Install component. This issue can be exploited by a remote attacker to disclose protected information using HTTP requests. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data in the Oracle Agile PLM Framework.

Recommendations For version 9.3.6, update to a newer version that contains a fix for this issue, as the current version allows unauthenticated attackers with network access via HTTP to compromise the Oracle Agile PLM Framework. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-01243

CVE-2025-21565

Affected Products

Oracle Agile Plm Framework

References · 6

• https://oracle.com/security-alerts/cpujan2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21565 · Security Note
• https://bdu.fstec.ru/vul/2025-01243 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21565 · Vendor Advisory
• https://t.me/cvedetector/16013 · Telegram Post
• https://twitter.com/CVEnew/status/1881821718454616376 · Twitter Post