CVE-2024-21287

CVE-2024-21287 is an incorrect authorization flaw (CWE-863) in the Software Development Kit and Process Extension components of the Oracle Agile PLM Framework, part of Oracle's Supply Chain portfolio. An unauthenticated attacker with network access via HTTP can exploit it with low attack complexity and no user interaction. Successful attacks allow unauthorized access to critical data, or potentially complete access to all data accessible through Agile PLM; the impact is confidentiality only (no integrity or availability impact). Only the supported release 9.3.6 of the Agile PLM Framework is listed as affected. The flaw is being actively exploited in the wild: Oracle has warned of active exploitation and shipped a patch, and CISA added it to the Known Exploited Vulnerabilities catalog on November 21, 2024.

What to do: Upgrade Agile PLM Framework 9.3.6 using the fix published in Oracle's Critical Patch Update advisory for this CVE, prioritizing instances reachable over HTTP. Because the flaw is under active exploitation, restrict network access to Agile PLM servers and review access logs for signs of unauthorized data reads. If patching is not immediately possible, follow CISA's required action: apply vendor mitigations or discontinue use of the product.