CVE DatabaseCVE-2024-21287

Updated 2026-06-17한국어 권고문 →

CVE-2024-212877.5/HIGHCISA KEVCWE-863CWE-863

Oracle Agile PLM Framework Remote Information Disclosure Vulnerability (CVE-2024-21287) Security Advisory

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

agile_plm_framework

Published Date

2024-11-18

CVSS v3.1

7.5

HIGH

EPSS (30d)

1.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Supply Chain - Oracle Agile PLM Framework version 9.3.6 (Software Development Kit, Process Extension component)

Impact

Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or complete access to all accessible data within the framework

Mitigation

Immediately apply the official security patches provided by Oracle and restrict external HTTP/HTTPS access to the affected system

Affected Products & Version Scope

Oracle Supply Chain - Oracle Agile PLM Framework version 9.3.6 (Affected components: Software Development Kit, Process Extension)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Refer to the Oracle Security Alert for CVE-2024-21287 to download the appropriate patch and apply it using the OPatch utility.

bash

# 1. Stop the Agile PLM Application Server and WebLogic Admin Server
cd /u01/app/oracle/Middleware/user_projects/domains/agileDomain/bin
./stopWebLogic.sh

# 2. Set OPatch environment and apply the official patch
export PATH=$PATH:/u01/app/oracle/Middleware/OPatch
cd /u01/app/oracle/patches/CVE-2024-21287
opatch apply

# 3. Restart the servers after successful patching
cd /u01/app/oracle/Middleware/user_projects/domains/agileDomain/bin
nohup ./startWebLogic.sh &

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict network access to the Agile PLM application. Implement IP-based access control lists (ACLs) on your reverse proxy or firewall to block untrusted external traffic.

nginx

# Example Nginx configuration to restrict access to sensitive PLM endpoints
server {
    listen 443 ssl;
    server_name agile.company.com;

    # Restrict access to SDK and Process Extension endpoints
    location ~* ^/(virtualpath-to-sdk|integration|ProcessExtension) {
        allow 10.0.0.0/8;
        deny all;
        proxy_pass http://agile_backend;
    }
}

3. Log Audit & IoC Verification Commands

Inspect WebLogic access logs for unauthorized or anomalous HTTP requests targeting the SDK or Process Extension components.

bash

# Search for unauthorized successful requests (HTTP 200) to SDK/Process Extension endpoints from external IPs
cd /u01/app/oracle/Middleware/user_projects/domains/agileDomain/servers/AgileServer/logs
grep -E '/(integration|sdk|ProcessExtension)' access.log | grep ' 200 ' | grep -v '10.0.'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild, immediately apply the official Oracle security patch to protect your Agile PLM infrastructure.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-21287) is an improper authorization flaw (CWE-863) within the Software Development Kit (SDK) and Process Extension components of the Oracle Agile PLM Framework. The root cause lies in the lack of proper access control and validation mechanisms when processing requests to sensitive internal resources.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability. By sending crafted HTTP requests to the vulnerable Agile PLM endpoints, the attacker bypasses authorization checks. This allows them to retrieve sensitive files, intellectual property, or system configuration data without requiring any user interaction or privileges. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

Successful exploitation can lead to a complete compromise of confidentiality, allowing unauthorized access to proprietary product designs, supply chain data, and intellectual property managed within the PLM system. This poses severe business risks, including intellectual property theft and regulatory non-compliance, reflected in its CVSS 3.1 Base Score of 7.5.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

https://www.oracle.com/security-alerts/alert-cve-2024-21287.html

Source: secalert_us@oracle.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21287

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2024-21287)

FAQ

Q1. How critical is CVE-2024-21287 and is it actively exploited in the wild?

CVE-2024-21287 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 1.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2024-21287?

Primary impacted vendors include oracle across agile_plm_framework. Scope summary: Oracle Supply Chain - Oracle Agile PLM Framework version 9.3.6 (Affected components: Software Development Kit, Process Extension)

Q3. What temporary mitigations or workarounds exist for CVE-2024-21287 before patching?

[Mitigation] Immediately apply the official security patches provided by Oracle and restrict external HTTP/HTTPS access to the affected system Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION