Oracle is warning that a high-severity security flaw impacting the Agile Product Lifecycle Management (PLM) Framework has been exploited in the wild.
The vulnerability, tracked as CVE-2024-21287 (CVSS score: 7.5), could be exploited sans authentication to leak sensitive information.
“This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password,” it said in an advisory. “If successfully exploited, this vulnerability may result in file disclosure.”
CrowdStrike security researchers Joel Snape and Lutz Wolf have been credited with discovering and reporting the flaw.
There is currently no information available on who is exploiting the vulnerability, the targets of the malicious activity, and how widespread these attacks are.
“If successfully exploited, an unauthenticated perpetrator could download, from the targeted system, files accessible under the privileges used by the PLM application,” Eric Maurice, vice president of Security Assurance at Oracle, said.
In light of active exploitation, users are recommended to apply the latest patches as soon as possible for optimal protection.
The Hacker News has reached out to Oracle and CrowdStrike for comment. We will update this story if we get a reply.