CVE-2024-21287
Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
Description
CVE-2024-21287 is a high-severity information disclosure vulnerability in Oracle Agile Product Lifecycle Management (PLM) Framework, specifically in the Software Development Kit and Process Extension components of version 9.3.6. The flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all data accessible through Oracle Agile PLM. With a CVSS v3.1 base score of 7.5 and a network-accessible attack vector requiring no authentication or user interaction, the vulnerability enables significant data exfiltration from enterprise product lifecycle management systems. CISA has added CVE-2024-21287 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 12, 2024, and its EPSS score of 69.83% at the 98.6th percentile indicates a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | agile product lifecycle management | 9.3.6 |
References
- https://www.oracle.com/security-alerts/alert-cve-2024-21287.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21287(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2024-21287 is associated with CWE-287 (Improper Authentication), a weakness where an application does not properly verify that a user has the claimed identity before granting access to protected resources. In Oracle Agile PLM, the Software Development Kit and Process Extension components fail to enforce authentication for certain operations, allowing unauthenticated attackers to access data that should require valid credentials. This authentication gap enables direct data retrieval through crafted HTTP requests without presenting any form of authentication.
CWE-22: Path Traversal
The vulnerability also involves elements of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), as the unauthenticated access may leverage path traversal techniques to reach data beyond the intended scope of the exposed endpoints, enabling broader data exposure across the PLM system.
Impact Analysis
The impact of CVE-2024-21287 is focused on confidentiality, which is rated as high. Oracle Agile PLM is an enterprise product lifecycle management system used by large organizations to manage product data, engineering specifications, compliance documentation, bills of materials, change orders, and supplier information throughout the product lifecycle. Unauthorized access to this data can expose proprietary product designs, manufacturing specifications, supply chain details, regulatory compliance documents, and competitive intelligence.
Integrity and availability are not directly impacted according to the CVSS vector (I:N/A:N), but the information disclosed through the vulnerability could enable subsequent attacks targeting these dimensions. Exposure of internal system architecture details, user information, or configuration data from the PLM system could facilitate further exploitation.
The attack requires no authentication (PR:N), no user interaction (UI:N), and has low complexity (AC:L), making it easily exploitable at scale. The EPSS score of 69.83% at the 98.6th percentile confirms exceptionally high exploitation probability. Oracle Agile PLM is deployed in large enterprises across manufacturing, aerospace, defense, automotive, and pharmaceutical industries, where the data it manages often includes trade secrets and regulated information subject to export control laws.
Exploit Maturity
CVE-2024-21287 demonstrates very high exploit maturity. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog, and the EPSS score of 69.83% at the 98.6th percentile places it among the top 1.4% of all vulnerabilities by exploitation probability.
The Oracle security alert provides the official vendor disclosure and patch information. Oracle published an out-of-band security alert for this vulnerability, which is unusual and indicates the severity of the active exploitation. While CISA has not confirmed a direct ransomware association, the vulnerability is being actively exploited by threat actors seeking to exfiltrate sensitive enterprise data from PLM systems. The combination of unauthenticated access, low exploitation complexity, and the high value of data stored in PLM systems makes CVE-2024-21287 an attractive target for both state-sponsored industrial espionage and financially motivated threat actors. Organizations running Oracle Agile PLM 9.3.6 should consider any internet-exposed instance as actively targeted.
Remediation
-
Apply the Oracle security patch immediately. Oracle has released an out-of-band security alert and corresponding patch for CVE-2024-21287. Consult the Oracle Security Alert for specific patch download and installation instructions for Oracle Agile PLM version 9.3.6.
-
Restrict network access to the Oracle Agile PLM application as an immediate compensating control. Ensure the PLM system is not directly accessible from the internet. Place it behind a reverse proxy or web application firewall, and restrict access to authorized internal networks and VPN users only.
-
Review access logs on the Oracle Agile PLM server for indicators of exploitation. Look for unauthenticated HTTP requests to SDK and Process Extension endpoints, unusual data retrieval patterns, requests from unexpected IP addresses, and high volumes of data access that may indicate automated exfiltration.
-
Assess data exposure by determining what information was potentially accessible through the vulnerability. Catalog the types of data stored in the PLM system, including product designs, engineering specifications, supplier information, and compliance documents. If exploitation is suspected, initiate incident response procedures appropriate to the sensitivity of the exposed data.
-
Implement network segmentation to limit the blast radius of any future PLM compromise. Ensure the PLM system communicates only with authorized systems and cannot be used as a pivot point to access other sensitive enterprise resources.
Technical Details
CVE-2024-21287 is an information disclosure vulnerability in Oracle Agile Product Lifecycle Management (PLM) Framework version 9.3.6. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-accessible attack with no prerequisites that results in high confidentiality impact.
The vulnerability resides in the Software Development Kit (SDK) and Process Extension components of Oracle Agile PLM. These components expose HTTP endpoints that fail to properly enforce authentication checks before processing requests. An unauthenticated attacker can send crafted HTTP requests to these endpoints to access data managed by the PLM system without presenting valid credentials.
Oracle Agile PLM's architecture includes an SDK layer that provides programmatic access to PLM data and a Process Extension framework for custom workflow integrations. The vulnerability in these components means that the intended authentication boundary is not properly enforced, allowing direct data access through the HTTP interface. The easily exploitable nature (AC:L) suggests that no special conditions or race conditions are required — standard HTTP requests are sufficient to trigger the data disclosure.
The scope is unchanged (S:U) as the vulnerability operates within the Oracle Agile PLM application's security context. Only version 9.3.6 is confirmed as affected, which is the currently supported version of this product. The vulnerability was significant enough to warrant an out-of-band security alert from Oracle, separate from their regular quarterly Critical Patch Update cycle, underscoring the urgency of the active exploitation.
Frequently Asked Questions
What is CVE-2024-21287?
CVE-2024-21287 is a high-severity information disclosure vulnerability in Oracle Agile Product Lifecycle Management (PLM) Framework version 9.3.6. It allows unauthenticated remote attackers to access sensitive product lifecycle data through the Software Development Kit and Process Extension components.
What type of data could be exposed through CVE-2024-21287?
Oracle Agile PLM manages product lifecycle data including engineering designs, bills of materials, change orders, supplier information, compliance documentation, and manufacturing specifications. All data accessible through the PLM system is potentially exposed to unauthorized access.
Is Oracle Agile PLM version 9.3.6 the only affected version?
Yes, Oracle has confirmed that version 9.3.6 is the supported version affected by this vulnerability. Organizations running this version should apply the patch from the Oracle Security Alert immediately.
Why did Oracle issue an out-of-band security alert?
Oracle issued an out-of-band alert because CVE-2024-21287 was being actively exploited in the wild. The urgency of the active exploitation warranted immediate disclosure and patching outside of Oracle's regular quarterly Critical Patch Update schedule.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.