Oracle Warns of Agile PLM Vulnerability Currently Under Active Exploitation

November 20, 2024

Oracle is warning that a high-severity security flaw impacting the Agile Product Lifecycle Management (PLM) Framework has been exploited in the wild.

The vulnerability, tracked as CVE-2024-21287 (CVSS score: 7.5), could be exploited sans authentication to leak sensitive information.

"This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password," it said in an advisory. "If successfully exploited, this vulnerability may result in file disclosure."

CrowdStrike security researchers Joel Snape and Lutz Wolf have been credited with discovering and reporting the flaw.

There is currently no information available on who is exploiting the vulnerability, the targets of the malicious activity, and how widespread these attacks are.

"If successfully exploited, an unauthenticated perpetrator could download, from the targeted system, files accessible under the privileges used by the PLM application," Eric Maurice, vice president of Security Assurance at Oracle, said.

In light of active exploitation, users are recommended to apply the latest patches as soon as possible for optimal protection.

The Hacker News has reached out to Oracle and CrowdStrike for comment. We will update this story if we get a reply.

source: TheHackerNews

Apple Releases Urgent Updates to Patch Actively Exploited Zero-Day Vulnerabilities

China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks