CVE-2024-21287

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 21, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-21295.4The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widgCVE-2024-21305.4The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and includCVE-2024-213026.7Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollbackCVE-2024-213038.8SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-213044.1Trusted Compute Base Elevation of Privilege VulnerabilityCVE-2024-213054.4Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass VulnerabilityCVE-2024-213065.7Microsoft Bluetooth Driver Spoofing VulnerabilityCVE-2024-213077.5Remote Desktop Client Remote Code Execution VulnerabilityCVE-2024-213088.8SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-213097.8Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityCVE-2024-21315.4The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget iCVE-2024-213107.8Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability