CVE-2024-20929: Oracle E-Business Suite Auth Bypass

CVE-2024-20929 Overview

CVE-2024-20929 is an access control weakness in the Oracle Application Object Library (FND) component of Oracle E-Business Suite. The flaw affects the DB Privileges subcomponent in supported versions 12.2.3 through 12.2.13. An unauthenticated remote attacker with HTTP network access can exploit the issue without user interaction. Successful exploitation grants unauthorized read access to a subset of data and unauthorized insert, update, or delete access to some data managed by the Oracle Application Object Library. Oracle addressed the issue in the January 2024 Critical Patch Update. The vulnerability is classified under CWE-284 (Improper Access Control).

Critical Impact
Unauthenticated network attackers can modify and read Oracle Application Object Library data over HTTP, affecting the integrity and confidentiality of ERP records across affected E-Business Suite deployments.

Affected Products

Oracle E-Business Suite — Oracle Application Object Library 12.2.3
Oracle E-Business Suite — Oracle Application Object Library 12.2.4 through 12.2.12
Oracle E-Business Suite — Oracle Application Object Library 12.2.13

Discovery Timeline

2024-01-16 - Oracle releases the January 2024 Critical Patch Update addressing the issue
2024-02-17 - CVE-2024-20929 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-20929

Vulnerability Analysis

The vulnerability resides in the DB Privileges subcomponent of the Oracle Application Object Library (FND). FND is the foundational framework that mediates authentication, authorization, and metadata for every module in Oracle E-Business Suite. A flaw in the access control logic allows requests over HTTP to reach data operations without proper privilege enforcement.

An attacker reaching the Oracle E-Business Suite web tier can trigger operations that read and modify a subset of FND-accessible data. Because FND governs cross-module data structures, integrity impact can propagate into higher-level business processes even when only a limited object set is directly reachable.

Oracle's advisory scopes the impact to confidentiality and integrity, with no availability effect. The Oracle Critical Patch Update - January 2024 is the authoritative reference for the fix and affected version matrix.

Root Cause

The root cause is improper access control (CWE-284) in the DB Privileges handling within FND. Privilege checks do not fully constrain the actions available to unauthenticated HTTP callers, allowing read and write operations against data that should require authenticated, authorized sessions.

Attack Vector

Exploitation requires only network access to the Oracle E-Business Suite HTTP interface. No credentials, elevated privileges, or user interaction are needed. Any internet-exposed or broadly reachable E-Business Suite front end running affected versions is in scope. Oracle does not publish exploitation details, and no public proof-of-concept has been observed for this CVE. The current EPSS probability is 0.322%.

No verified exploitation code is available for this vulnerability. Refer to Oracle's advisory for authoritative technical guidance.

Detection Methods for CVE-2024-20929

Indicators of Compromise

Unexpected changes to FND tables such as FND_USER, FND_RESPONSIBILITY, or profile option tables without matching authenticated session records in audit logs.
Anonymous or unauthenticated HTTP requests to E-Business Suite endpoints that succeed against FND-related URLs.
Web tier access logs showing HTTP requests to Application Object Library endpoints from unusual source IPs or during off-hours.

Detection Strategies

Compare the deployed E-Business Suite patch level against the January 2024 Critical Patch Update baseline and flag hosts missing the FND fix.
Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking to identify unauthenticated requests reaching FND components.
Monitor database audit trails for INSERT, UPDATE, or DELETE operations on FND-owned schemas that originate from web tier sessions lacking authenticated user context.

Monitoring Recommendations

Forward Oracle HTTP Server, WebLogic, and database audit logs to a centralized analytics platform for correlation across the E-Business Suite stack.
Alert on HTTP 2xx responses to Application Object Library URIs from sources outside expected administrative networks.
Baseline FND write activity per business hour and alert on statistically significant deviations that could indicate unauthorized data modification.

How to Mitigate CVE-2024-20929

Immediate Actions Required

Apply the Oracle E-Business Suite patches from the January 2024 Critical Patch Update to all Application Object Library instances running versions 12.2.3 through 12.2.13.
Inventory internet-exposed E-Business Suite web tiers and restrict access to trusted networks until patching is complete.
Review FND audit tables for unauthorized changes made prior to remediation and validate the integrity of critical configuration data.

Patch Information

Oracle addressed CVE-2024-20929 in the January 2024 Critical Patch Update. Administrators should follow Oracle's E-Business Suite patching guidance to apply the FND fixes for the affected 12.2.x release train. Patch details, prerequisites, and post-installation steps are documented in the Oracle Critical Patch Update - January 2024 advisory.

Workarounds

Place the Oracle E-Business Suite web tier behind a reverse proxy or web application firewall that enforces authentication before requests reach FND endpoints.
Restrict inbound HTTP access to Application Object Library URLs using network access control lists limited to administrative subnets.
Enable enhanced database auditing on FND-owned schemas to detect and roll back unauthorized data changes until patching is completed.

bash

# Verify installed Oracle E-Business Suite patch level
# Run from an application tier as the applmgr user after sourcing the environment file
adop -status
sqlplus apps/<password> @$AD_TOP/sql/adutconf.sql