## Summary
A vulnerability in Oracle Agile PLM (Oracle Supply Chain), specifically the Folders, Files & Attachments component, affects supported version 9.3.6. It is described as difficult to exploit but can be used by a low-privileged attacker with network access via HTTP to compromise the application, potentially resulting in takeover.
## Technical Details
- Affected component: Folders, Files & Attachments in Oracle Agile PLM.
- Attack vector: NETWORK via HTTP.
- Attacker privileges: PR:L (low privileged).
- User interaction: UI:N (no user interaction required).
- Complexity: AC:H (difficult to exploit).
- Impact scope: S:U (unchanged scope).
- CIA impact: C:H, I:H, A:H (high confidentiality, integrity, and availability impact).
## Affected
- Oracle Agile PLM (Oracle Supply Chain), component Folders, Files & Attachments
- Version: 9.3.6
## Impact
- Potential application takeover of Oracle Agile PLM.
- High impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
## Mitigation
1. Patch immediately: apply the vendor’s fix for Oracle Agile PLM 9.3.6 (no reference patch details were available in the provided material).
2. Restrict network access to the affected HTTP surface (limit exposure to trusted networks/hosts).
3. Reduce attacker leverage by enforcing least privilege for accounts that can access the affected functionality (given PR:L).
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H