Oracle Warns of Agile PLM Vulnerability Currently Under Active Exploitation

Oracle is warning that a high-severity security flaw impacting the Agile Product Lifecycle Management (PLM) Framework has been exploited in the wild.

The vulnerability, tracked as CVE-2024-21287 (CVSS score: 7.5), could be exploited sans authentication to leak sensitive information.

“This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password,” it said in an advisory. “If successfully exploited, this vulnerability may result in file disclosure.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

CrowdStrike security researchers Joel Snape and Lutz Wolf have been credited with discovering and reporting the flaw.

There is currently no information available on who is exploiting the vulnerability, the targets of the malicious activity, and how widespread these attacks are.

“If successfully exploited, an unauthenticated perpetrator could download, from the targeted system, files accessible under the privileges used by the PLM application,” Eric Maurice, vice president of Security Assurance at Oracle, said.

In light of active exploitation, users are recommended to apply the latest patches as soon as possible for optimal protection.

The Hacker News has reached out to Oracle and CrowdStrike for comment. We will update this story if we get a reply.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.