← CVE Radar
CVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
8.8 HIGHEPSS 3.93%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1oracle (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Mar 17, 2025
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2024-20953
- Status
- Analyzed
- Assigner (CNA)
- oracle
- Published
- Feb 17, 2024
- Last modified
- 2026-06-17 07:08 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Oracle CorporationAgile PLM Framework1 version range
- 9.3.6