Critical Vulnerability Found in Oracle’s “Agile PLM” Framework

Oracle has issued an urgent security alert regarding a critical vulnerability in its Agile Product Lifecycle Management (PLM) framework, which is currently being actively exploited in real-world attacks.

The vulnerability, identified as CVE-2024-21287, allows unauthenticated attackers to gain access to the systems. This high-severity vulnerability is associated with Oracle Agile PLM Framework version 9.3.6, particularly in the Software Development Kit (SDK) and Process Extension components.

The vulnerability has been rated with a CVSS base score of 7.5 and can be remotely exploited via HTTP or HTTPS protocols. If successfully exploited, an attacker could gain unauthorized access to critical data or potentially gain full access to all data within the Oracle Agile PLM Framework.

This vulnerability could lead to file disclosure, allowing attackers to download files accessible under the privileges of the PLM application. This could result in the exposure of critical business information and internal documents.

While the exact details of ongoing attacks are unknown, Oracle has confirmed that the vulnerability is being actively exploited in the wild.

Oracle has released a security patch to address CVE-2024-21287 and strongly recommends that customers apply the security update as soon as possible.

Recommendations for Affected Organizations:

  • Apply Security Patches: Immediately install the latest available security patches from Oracle.
  • Review System Logs: Check system logs for signs of unauthorized access or file downloads.
  • Monitor Suspicious Activity: Closely monitor for any suspicious activity related to the Agile PLM Framework.

This incident highlights the importance of timely updates and the ongoing challenges organizations face in securing enterprise software. As attackers continue to exploit vulnerabilities in widely used business applications, quick responses to security alerts become crucial in preventing data breaches and unauthorized access.

Oracle urges its customers to remain vigilant and prioritize the application of this security update to mitigate the risk posed by the actively exploited zero-day vulnerability in the Agile PLM Framework.

This situation serves as a reminder of the ongoing challenges in securing business applications and the critical importance of implementing effective updates to address vulnerabilities.

Skip to content