Oracle Warns of Agile PLM Vulnerability Currently Under Active Exploitation

Oracle is warning that a high-severity security flaw impacting the Agile Product Lifecycle Management (PLM) Framework has been exploited in the wild.

The vulnerability, tracked as CVE-2024-21287 (CVSS score: 7.5), could be exploited sans authentication to leak sensitive information.

“This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password,” it said in an advisory. “If successfully exploited, this vulnerability may result in file disclosure.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

CrowdStrike security researchers Joel Snape and Lutz Wolf have been credited with discovering and reporting the flaw.

There is currently no information available on who is exploiting the vulnerability, the targets of the malicious activity, and how widespread these attacks are.

“If successfully exploited, an unauthenticated perpetrator could download, from the targeted system, files accessible under the privileges used by the PLM application,” Eric Maurice, vice president of Security Assurance at Oracle, said.

In light of active exploitation, users are recommended to apply the latest patches as soon as possible for optimal protection.

The Hacker News has reached out to Oracle and CrowdStrike for comment. We will update this story if we get a reply.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.