CVE-2024-20953

Published: Feb 17, 2024Modified: Jun 17, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secalert_us@oracle.com (Secondary)

Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected (1)

Products: Oracle: Agile Product Lifecycle Management

1 product

Agile Product Lifecycle Management

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Product Lifecycle Management	Version 9.3.6

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://www.oracle.com/security-alerts/cpujan2024.html

Source: secalert_us@oracle.com

Vendor Advisory

https://www.oracle.com/security-alerts/cpujan2024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20953

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

https://www.zerodayinitiative.com/advisories/ZDI-24-096/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party Advisory

Timeline

No history available yet.