{"id":"CVE-2024-21287","published":"2024-11-18T22:15:05Z","modified":"2026-06-17T07:08:56Z","title":"Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability","vendor":"Oracle","product":"Agile Product Lifecycle Management (PLM)","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provenance":"source","from":"NVD"},"summary":{"text":"An incorrect authorization flaw in the Software Development Kit and Process Extension components of Oracle Agile Product Lifecycle Management (PLM) Framework, within Oracle Supply Chain, affects version 9.3.6. An unauthenticated attacker with network access over HTTP can easily exploit it to gain unauthorized access to critical data or to all data accessible through Oracle Agile PLM Framework, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:36Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.01723,"percentile":0.7744,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-11-21","dueDate":"2024-12-12","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/alert-cve-2024-21287.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-21287","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-11-18","exploitedFirstSeen":"2024-11-18","ransomware":false,"evidence":[{"url":"https://blogs.oracle.com/security/post/alert-cve-2024-21287","date":"2024-11-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-11-21"},{"url":"https://www.crowdstrike.com/explore/2025-global-threat-report","date":"2025-02-27"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2024-21287.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21287","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network HTTP exploitation of exposed application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP","start":188,"end":281}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthorized access yields data retrieval from the application","mappingType":"primary_impact","evidence":[{"from":"description","quote":"unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data","start":381,"end":486}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19000","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19000","exploited":true,"exploitedSince":"2024-11-21","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2024-11-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21287","provenance":"source"},{"date":"2024-11-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blogs.oracle.com/security/post/alert-cve-2024-21287","provenance":"source"},{"date":"2024-11-21","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-11-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19000","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":3},"priority":{"score":58.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 711 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.49,"detail":"percentile 0.7744"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}