CVE-2024-21092: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2024-21092 Overview

CVE-2024-21092 affects Oracle Agile Product Lifecycle Management for Process version 6.2.4.2, specifically the Product Quality Management component within the Oracle Supply Chain product family. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible by the application. Oracle published the fix as part of the April 2024 Critical Patch Update.

Critical Impact
An authenticated attacker with low privileges can compromise the confidentiality and integrity of all data managed by Oracle Agile PLM for Process 6.2.4.2 over the network.

Affected Products

Oracle Agile Product Lifecycle Management for Process 6.2.4.2
Component: Product Quality Management
Oracle Supply Chain product family

Discovery Timeline

2024-04-16 - CVE-2024-21092 published to the National Vulnerability Database (NVD)
2024-04-16 - Oracle releases fix in the Oracle Security Alert April 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21092

Vulnerability Analysis

The flaw resides in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process. Oracle's advisory classifies the issue as easily exploitable over HTTP by an authenticated attacker holding low-level privileges. The NVD entry maps the weakness to NVD-CWE-noinfo, indicating Oracle did not disclose the underlying weakness category.

Successful exploitation yields high confidentiality and integrity impact but no availability impact. The attacker can read, create, modify, or delete any data the application can access. Because the scope is unchanged, the compromise is limited to the vulnerable application context rather than extending to other components.

The EPSS probability is 0.596%, placing the CVE in the 45th percentile for likelihood of exploitation. No public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle has not published the underlying weakness class in the public advisory. The vendor advisory describes the issue only at a functional level, tying it to the Product Quality Management component. The vulnerability requires an authenticated session, indicating that the flaw likely resides in a post-authentication code path exposed over HTTP.

Attack Vector

Exploitation requires network reachability to the Oracle Agile PLM for Process HTTP interface and valid low-privileged credentials. No user interaction is needed. An attacker can send crafted HTTP requests to the vulnerable component to trigger unauthorized data access and modification. Refer to the Oracle Security Alert April 2024 for vendor-supplied technical guidance.

Detection Methods for CVE-2024-21092

Indicators of Compromise

Unexpected create, update, or delete operations on Product Quality Management records executed by low-privileged user accounts.
HTTP request patterns targeting Product Quality Management endpoints from unusual source IP addresses or at abnormal request rates.
Application logs showing data access outside the normal role scope of authenticated users.

Detection Strategies

Enable and review Oracle Agile PLM for Process application-level audit logs for anomalous data-modification events tied to low-privileged accounts.
Correlate HTTP access logs from the web tier with database change events to identify unauthorized modifications originating from the Product Quality Management component.
Baseline normal user behavior in the application and alert on deviations such as bulk data reads or writes by accounts that historically perform limited actions.

Monitoring Recommendations

Forward Oracle Agile PLM for Process web server, application, and database logs to a centralized SIEM for continuous inspection.
Alert on authentication events from newly created or dormant low-privileged accounts that begin issuing HTTP requests to Product Quality Management URLs.
Track outbound data volumes from the application server to detect large-scale data exfiltration following a successful compromise.

How to Mitigate CVE-2024-21092

Immediate Actions Required

Apply the April 2024 Critical Patch Update from Oracle to all instances of Oracle Agile Product Lifecycle Management for Process 6.2.4.2.
Inventory all Oracle Agile PLM for Process deployments and confirm patch status against the vendor advisory.
Rotate credentials for accounts that could interact with the Product Quality Management component if compromise is suspected.

Patch Information

Oracle addressed CVE-2024-21092 in the April 2024 Critical Patch Update. Administrators must download and apply the relevant patch bundle from the Oracle Security Alert April 2024. Oracle recommends applying Critical Patch Update fixes without delay because unpatched systems remain exposed to publicly disclosed issues.

Workarounds

Restrict network access to the Oracle Agile PLM for Process HTTP interface to trusted management networks using firewall or reverse-proxy access controls.
Enforce least-privilege role assignments and remove unnecessary access to the Product Quality Management component until the patch is applied.
Require multi-factor authentication for all Oracle Agile PLM for Process user accounts to raise the cost of credential-based attacks.

bash

# Example: restrict access to Oracle Agile PLM for Process HTTP interface
# Replace <trusted_subnet> and <plm_host> with environment-specific values
iptables -A INPUT -p tcp --dport 443 -s <trusted_subnet> -d <plm_host> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <plm_host> -j DROP