Joel Snape

**Name of the Vulnerable Software and Affected Versions** Oracle Agile PLM Framework version 9.3.6 **Description** The issue is related to insufficient input validation in the Agile Integration Services component, allowing a low-privileged attacker with network access via HTTP to compromise the Oracle Agile PLM Framework. This can result in the takeover of the system, impacting confidentiality, integrity, and availability. The vulnerability is easily exploitable and can significantly affect additional products. Oracle has released a patch to address this flaw as part of its January 2025 Critical Patch Update, which includes fixes for 318 vulnerabilities across its products. **Recommendations** For version 9.3.6, update to a newer version that includes the fix for this issue, as provided in Oracle's January 2025 Critical Patch Update. As a temporary workaround, consider restricting access to the Agile Integration Services component to minimize the risk of exploitation. Avoid using the vulnerable component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Oracle Agile PLM version 9.3.6 **Description** An incorrect authorization issue exists in the Oracle Agile PLM Framework of Oracle Supply Chain, specifically within the Software Development Kit Process Extension component. This flaw is caused by insufficient input validation and allows an unauthenticated remote attacker with network access via HTTP to bypass authentication. Successful exploitation enables the attacker to disclose protected information, access critical data, or download sensitive files from the system. This issue has been actively exploited in real-world attacks. **Recommendations** Apply security patches for version 9.3.6 immediately.