CVE-2024-20953

8.8

HIGH

Oracle Agile Product Lifecycle Management (PLM) De - [Actively Exploited]

Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

INFO

Published Date :

Feb. 17, 2024, 2:15 a.m.

Last Modified :

Feb. 25, 2025, 2 a.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.8

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 17, 2025

Alert Date: Feb 24, 2025 | 56 days ago

Description :

Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://www.oracle.com/security-alerts/cpujan2024.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-20953

Affected Products

The following products are affected by CVE-2024-20953 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Oracle	agile_plm
2	Oracle	agile_product_lifecycle_management

: Total Affected Vendor : 1 | Products : 2

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-20953.

URL	Resource
https://www.oracle.com/security-alerts/cpujan2024.html	Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2024.html	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-096/

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-20953 vulnerability anywhere in the article.

The Cyber Express

Cleveland Municipal Court Remains Closed Due to Ongoing Cybersecurity Incident

Cleveland Municipal Court has been closed for three consecutive days following a cybersecurity incident that has disrupted its internal systems. The court announced the closure on Monday and has since ...

Published Date: Feb 28, 2025 (1 month, 3 weeks ago)

CVE-2025-27364 CVE-2024-20953 CVE-2017-3066

The Cyber Express

Black Basta Chat Logs Reveal Ransomware Group’s TTPs, IoCs

The Black Basta ransomware group has fallen off dramatically in 2025, and chat logs leaked recently show that internal squabbling may be behind the group’s slowed activity. Cyble threat intelligence r ...

Published Date: Feb 26, 2025 (1 month, 3 weeks ago)

CVE-2024-3400 CVE-2024-26169 CVE-2024-1709 CVE-2024-20953 CVE-2024-21762 CVE-2024-1086 CVE-2024-23897 CVE-2022-41082 CVE-2022-41040 CVE-2022-41352 ...+10 more CVE

The Register

200-plus impressively convincing GitHub repos are serving up malware

Infosec bytes Kaspersky says it has found more than 200 GitHub repos hosting fairly convincing-looking fake projects laced with malicious software. The Russian infosec house reckons the rotten reposit ...

Published Date: Feb 26, 2025 (1 month, 3 weeks ago)

CVE-2024-20953 CVE-2017-3066

The Cyber Express

CISA Warns of Actively Exploited Adobe ColdFusion and Oracle Agile PLM Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) Catalog by adding two critical vulnerabilities, both actively being exploited ...