CVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
Aktif olarak istismar ediliyor — Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 24.02.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 17.03.2025.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.oracle.com/security-alerts/cpujan2024.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-20953
Açıklama
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Oracle Corporation | Agile PLM Framework | 9.3.6 | |
| oracle | agile product lifecycle management | 9.3.6 |
Kaynaklar ve yamalar
- Oracle Advisory vendor-advisoryVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20953 US Government Resource
- https://www.zerodayinitiative.com/advisories/ZDI-24-096/ Third Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*