oracle agile-product-lifecycle-management CVE-2024-20953 vulnerability in Oracle Products
Published on February 17, 2024

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.

The following remediation steps are recommended / required by March 17, 2025: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2024-20953 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.


Products Associated with CVE-2024-20953

You can be notified by stack.watch whenever vulnerabilities like CVE-2024-20953 are published in these products:

Oracle Agile Product Lifecycle Management
 
Oracle
 

What versions are vulnerable to CVE-2024-20953?