CVE-2024-20956
Reported by oracle · Published February 17, 2024
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). Supported versions that are affected are Prior to 6.2.4.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| agile_product_lifecycle_management_for_process | oracle | 6.2.4.2 |
| Agile Product Lifecycle Management for Process | Oracle Corporation | 6.2.4.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | Agile Product Lifecycle Management for Process | * |
| Oracle Corporation | Agile Product Lifecycle Management for Process | * |
| oracle | agile_product_lifecycle_management_for_process | 0 |
Timeline
- Jan 16, 2024 CVE Published
- Feb 10, 2024 PoC Published
- Feb 17, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (6 in total, the first dated here)
- Feb 24, 2025 CVE Updated
- Mar 31, 2026 Security Advisory (2 in total, the first dated here)
- Nov 4, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-20956
vulnetix vdb fixes CVE-2024-20956Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-20956/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Oracle Advisory vendor-advisory