What is CVE-2024-21287?

CVE-2024-21287 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2024-11-18.

How severe is CVE-2024-21287?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2024-21287 known to be exploited?

Yes. CVE-2024-21287 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-11-21), indicating it is being actively exploited. 3 public proof-of-concept repositories are indexed.

Auth bypass in Oracle Agile Product Lifecycle Management

CVE-2024-21287

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Vulnerability class: Broken Access Control

EPSS: 0.015 (71.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Oracle Agile_product_lifecycle_management — versions 9.3.6
Oracle Corporation Agile Plm Framework — versions 9.3.6

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2024-11-21. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2024-12-12.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public proof-of-concept exploits

References

secalert_us@oracle.com (vendor-advisory, Vendor Advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2024-21287?: CVE-2024-21287 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2024-11-18.
How severe is CVE-2024-21287?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2024-21287 known to be exploited?: Yes. CVE-2024-21287 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-11-21), indicating it is being actively exploited. 3 public proof-of-concept repositories are indexed.