CVE-2024-20953highunder attackCWE-502

CVE-2024-20953: high-severity vulnerability in Oracle Corporation Agile PLM Framework

Published · Updated

Follow this CVE+ Monitor Oracle Agile Product Lifecycle Management for Process+ Monitor Agile PLM Framework

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 3.9%
from disclosure to weapon
Published on NVDFeb 17
CISA KEV+373d
Action required by CISAfederal deadline: 2025-03-17

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Oracle Agile PLM version 9.3.6 has a flaw in its export feature that allows a logged-in user to take complete control of the system through a network request. This vulnerability can lead to theft, modification, or destruction of data.

Technical detail

CWE-502 (Deserialization of Untrusted Data) vulnerability in Oracle Agile PLM 9.3.6 export component. Attack vector is network-based (HTTP), requires low-privilege authenticated access, and no user interaction. Successful exploitation results in complete system compromise (confidentiality, integrity, and availability impact).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Oracle Corporation · Agile PLM Framework
Related CVEs — Oracle Corporation Agile PLM Framework

In the same product, most dangerous first.

CVE-2017-10093—CVE-2017-10093EPSS 2.0%CVE-2017-10082—CVE-2017-10082EPSS 1.5%CVE-2017-10092—CVE-2017-10092EPSS 1.5%CVE-2017-10052—CVE-2017-10052EPSS 1.5%CVE-2017-10080—CVE-2017-10080EPSS 1.5%CVE-2020-2920MEDIUMCVE-2020-2920EPSS 1.2%