CVE-2024-20935 Overview
CVE-2024-20935 is a vulnerability in the Oracle Installed Base product of Oracle E-Business Suite, specifically within the Engineering Change Order component. Affected versions span 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the flaw, but successful exploitation requires user interaction from a victim other than the attacker. The vulnerability crosses a security scope boundary, meaning it can affect resources beyond Oracle Installed Base itself. Successful attacks can result in unauthorized update, insert, or delete access to a subset of Installed Base data, along with unauthorized read access to a subset of Installed Base data.
Critical Impact
Exploitation permits limited write and read access to Oracle Installed Base data and, due to a scope change, may impact adjacent Oracle E-Business Suite products when a legitimate user is tricked into interacting with attacker-controlled input.
Affected Products
- Oracle Installed Base 12.2.3
- Oracle Installed Base versions 12.2.4 through 12.2.12
- Oracle Installed Base 12.2.13
Discovery Timeline
- 2024-02-17 - CVE-2024-20935 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-20935
Vulnerability Analysis
The flaw resides in the Engineering Change Order component of Oracle Installed Base, part of Oracle E-Business Suite. The vulnerability is reachable over the network via HTTP without prior authentication. Exploitation requires human interaction from a user other than the attacker, consistent with client-side attack patterns such as reflected script injection or link-based delivery. Because the vulnerability triggers a scope change, actions initiated in Oracle Installed Base can affect data or components outside the vulnerable module. The Common Weakness Enumeration (CWE) mapping is listed as NVD-CWE-noinfo, indicating Oracle has not disclosed the specific weakness class in public documentation.
Root Cause
Oracle has not published detailed root-cause information for this issue. The public advisory in the Oracle Critical Patch Update for January 2024 confirms the affected component and impact profile but withholds implementation-level details, which is standard practice for E-Business Suite advisories.
Attack Vector
An unauthenticated remote attacker crafts a malicious HTTP request or link targeting the Engineering Change Order functionality of Oracle Installed Base. The attacker then induces an authenticated Oracle E-Business Suite user to visit the link or perform an action, most commonly through phishing or web-based social engineering. Upon interaction, the malicious payload is processed in the victim's session context, granting the attacker limited ability to read, modify, or delete Installed Base records and to affect adjacent products within the E-Business Suite footprint.
No verified proof-of-concept or exploit code is publicly available for this CVE. Refer to the Oracle Security Alert - January 2024 Critical Patch Update for authoritative technical guidance.
Detection Methods for CVE-2024-20935
Indicators of Compromise
- Unexpected create, update, or delete operations against Oracle Installed Base tables tied to Engineering Change Order workflows.
- Inbound HTTP requests to E-Business Suite endpoints containing anomalous query parameters or redirect chains directed at Installed Base URLs.
- Session activity where a valid user account performs Installed Base actions immediately after clicking an external link or opening an email attachment.
Detection Strategies
- Enable and review Oracle E-Business Suite application audit logs for unauthorized changes originating from Installed Base and Engineering Change Order transactions.
- Correlate web server access logs with user session identifiers to identify HTTP requests initiated from external referrers targeting Installed Base modules.
- Monitor for phishing campaigns referencing Oracle E-Business Suite URLs in email security gateways.
Monitoring Recommendations
- Alert on anomalous volumes of Installed Base record modifications outside of normal business hours or by users without a documented Engineering Change Order role.
- Track authentication and session events to identify accounts whose behavior deviates from established baselines after external link interaction.
- Ingest Oracle E-Business Suite application, database, and web-tier logs into a centralized SIEM for cross-tier correlation.
How to Mitigate CVE-2024-20935
Immediate Actions Required
- Apply the fixes distributed in the Oracle Critical Patch Update for January 2024 to all Oracle Installed Base deployments running versions 12.2.3 through 12.2.13.
- Inventory Oracle E-Business Suite environments to confirm the exact Installed Base version and patch level on each instance.
- Brief E-Business Suite users on phishing and link-based attack awareness given the user-interaction requirement.
Patch Information
Oracle addressed CVE-2024-20935 in the January 2024 Critical Patch Update. Administrators should consult the Oracle Security Alert - January 2024 Critical Patch Update for the applicable patch identifiers, prerequisite patches, and installation instructions specific to their E-Business Suite release train.
Workarounds
- Restrict network exposure of the Oracle E-Business Suite web tier so that only trusted internal networks and VPN clients can reach Installed Base endpoints.
- Enforce strict Content Security Policy and same-origin controls on the E-Business Suite reverse proxy to reduce the impact of client-side payload delivery.
- Deploy web application firewall rules that inspect HTTP requests targeting Installed Base Engineering Change Order URLs for suspicious parameters or encoded payloads.
No vendor-supplied configuration workaround is documented for this vulnerability. Patch application remains the authoritative remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.