CVE-2024-20953

Published Feb 17, 2024

Last updated 23 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-20953 is a deserialization vulnerability found in Oracle Agile Product Lifecycle Management (PLM), specifically version 9.3.6. This vulnerability exists within the Export component of the affected software. Successful exploitation allows a low-privileged attacker with network access via HTTP to compromise the affected system. This vulnerability was patched by Oracle in January 2024. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-20953 to its Known Exploited Vulnerabilities (KEV) catalog in February 2025 due to evidence of active exploitation. Federal agencies are required to patch this vulnerability by March 17, 2025.

Description: Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Source: secalert_us@oracle.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
Exploit added on: Feb 24, 2025
Exploit action due: Mar 17, 2025
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4305ED0E-30CC-4AEA-8988-3D1EC93A0BB2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]