CVE-2024-20953
Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
Description
CVE-2024-20953 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management (PLM) version 9.3.6 that allows a low-privileged attacker with network access via HTTP to achieve complete takeover of the application. Rated with a CVSS v3.1 base score of 8.8, the vulnerability resides in the Export component and is easily exploitable without requiring user interaction. CISA has added CVE-2024-20953 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 17, 2025. The EPSS score of 69.04% at the 98.6th percentile places this among the most likely exploited vulnerabilities tracked, underscoring the critical urgency for organizations running Oracle Agile PLM to apply patches immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | agile product lifecycle management | 9.3.6 |
References
- https://www.oracle.com/security-alerts/cpujan2024.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20953(US Government Resource)
- https://www.zerodayinitiative.com/advisories/ZDI-24-096/(Third Party Advisory)
Weakness Type
Deserialization / Input Validation Weakness
CVE-2024-20953 is associated with an unspecified weakness in Oracle Agile PLM's Export component. Based on the vulnerability characteristics — low-privileged network access leading to full system takeover with high confidentiality, integrity, and availability impact — this is consistent with an insecure deserialization or input validation flaw. The Export functionality likely processes user-supplied data in a way that allows an attacker to inject malicious payloads that are deserialized or executed by the server, leading to complete compromise of the Oracle Agile PLM instance.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2024-20953 represents a severe threat to organizations using Oracle Agile PLM for product lifecycle management. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), requiring only low-level privileges (PR:L) and no user interaction (UI:N). Confidentiality (High): Successful exploitation grants the attacker full read access to all data managed by Oracle Agile PLM, including proprietary product designs, engineering specifications, bill of materials, supplier information, and compliance documentation. For manufacturing and technology organizations, this represents a catastrophic intellectual property exposure. Integrity (High): An attacker can modify product data, alter engineering change orders, manipulate compliance records, and tamper with supply chain information, potentially leading to defective products, regulatory violations, or supply chain compromise. Availability (High): Full system takeover enables the attacker to disrupt PLM operations, delete critical product data, or render the system unusable, directly impacting product development timelines and manufacturing processes. The EPSS score of 69.04% at the 98.6th percentile indicates a very high probability of exploitation, and the KEV catalog inclusion with ransomware status listed as Unknown means this vulnerability could potentially be leveraged in ransomware campaigns targeting manufacturing and engineering organizations.
Exploit Maturity
CVE-2024-20953 demonstrates advanced exploit maturity. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 17, 2025. The Zero Day Initiative advisory ZDI-24-096 provides additional technical details about the vulnerability, indicating that it was discovered through coordinated disclosure. The EPSS score of 69.04% at the 98.6th percentile places this vulnerability among the top 1.4% of all tracked CVEs in terms of exploitation likelihood, confirming widespread and active exploitation. The ransomware use status is listed as Unknown by CISA. Oracle has published remediation guidance in the January 2024 Critical Patch Update, confirming the vulnerability and providing patches.
Remediation
-
Apply the Oracle January 2024 Critical Patch Update immediately. Download and install the patch from the Oracle Security Alerts page that addresses CVE-2024-20953 in Oracle Agile PLM version 9.3.6. Follow Oracle's patching instructions carefully and test in a staging environment before applying to production.
-
Restrict network access to Oracle Agile PLM. Implement network segmentation to limit which systems and users can reach the Agile PLM HTTP interface. Place the application behind a web application firewall (WAF) and restrict access to only authorized internal networks and VPN connections.
-
Audit user privileges and Export component usage. Review all user accounts with access to the Export functionality in Oracle Agile PLM. Remove unnecessary accounts and enforce least-privilege access. Monitor Export component usage logs for any unusual activity that could indicate prior exploitation.
-
Conduct forensic investigation on exposed instances. If Oracle Agile PLM has been accessible from the internet or untrusted networks, perform a thorough forensic analysis to identify any signs of compromise, including unauthorized data exports, modified product records, or suspicious user account activity.
-
Plan migration to supported versions. Oracle Agile PLM 9.3.6 is the affected version, and organizations should evaluate their upgrade path to ensure continued security support and timely access to future patches.
Technical Details
CVE-2024-20953 is a vulnerability in the Export component of Oracle Agile Product Lifecycle Management (PLM) version 9.3.6, part of the Oracle Supply Chain product suite. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reveals the following attack characteristics: Attack Vector (Network): The vulnerability is exploitable remotely via HTTP, meaning any authenticated user with network access to the Agile PLM web interface can launch the attack. Attack Complexity (Low): Oracle explicitly states this is "easily exploitable," requiring no specialized conditions or race conditions. Privileges Required (Low): Only a basic authenticated user account is needed — no administrative privileges are required to exploit the vulnerability. User Interaction (None): The attack can be executed entirely by the attacker without requiring any action from other users or administrators. Scope (Unchanged): The exploit operates within the security context of the Oracle Agile PLM application, though the impact is a complete takeover of that system. Impact (High across all three dimensions): Successful exploitation results in full compromise of confidentiality, integrity, and availability of the Oracle Agile PLM instance. The Export component processes data in a way that can be abused by a low-privileged attacker to execute operations beyond their authorization level, ultimately achieving complete control over the PLM system and all its managed data.
Frequently Asked Questions
Is CVE-2024-20953 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2024-20953 in the Known Exploited Vulnerabilities catalog with a remediation deadline of March 17, 2025. The EPSS score of 69.04% at the 98.6th percentile further confirms that this is among the most actively exploited vulnerabilities currently tracked.
What products are affected by CVE-2024-20953?
CVE-2024-20953 affects Oracle Agile Product Lifecycle Management (PLM) version 9.3.6, which is part of the Oracle Supply Chain product suite. The vulnerability specifically resides in the Export component of the application.
How do I fix CVE-2024-20953?
Apply the Oracle January 2024 Critical Patch Update that addresses CVE-2024-20953. The patch is available from Oracle's security alerts page. Additionally, restrict network access to Oracle Agile PLM instances and audit user privileges, particularly for the Export functionality.
How severe is CVE-2024-20953?
CVE-2024-20953 is rated High with a CVSS v3.1 base score of 8.8 out of 10. The vulnerability allows a low-privileged authenticated attacker to achieve complete takeover of Oracle Agile PLM, with maximum impact to confidentiality, integrity, and availability. Oracle has confirmed it is easily exploitable with no user interaction required.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.