CVE-2024-21287: Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
First published: Mon Nov 18 2024(Updated: )
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
Credit: secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Agile Product Lifecycle Management | =9.3.6 | |
| Oracle Agile Product Lifecycle Management |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-21287?
CVE-2024-21287 is classified as a high-severity vulnerability due to the potential for unauthenticated file disclosure.
How do I fix CVE-2024-21287?
To remediate CVE-2024-21287, it is recommended to apply the latest security patches provided by Oracle for the affected versions.
Which versions of Agile Product Lifecycle Management are affected by CVE-2024-21287?
CVE-2024-21287 affects Oracle Agile Product Lifecycle Management version 9.3.6.
What type of vulnerability is CVE-2024-21287?
CVE-2024-21287 is an incorrect authorization vulnerability that allows for unauthenticated file disclosure.
What can an attacker achieve by exploiting CVE-2024-21287?
Exploitation of CVE-2024-21287 can lead to unauthorized access to sensitive files stored within the Oracle Agile Product Lifecycle Management system.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/weakness
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-21287
- agent/remedy
- agent/title
- agent/references
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-cve
- agent/event
- agent/source
- agent/trending
- agent/tags
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle agile product lifecycle management
- version/oracle agile product lifecycle management/9.3.6