CVE-2024-20941: Oracle Installed Base Auth Bypass Vulnerability

CVE-2024-20941 Overview

CVE-2024-20941 is a vulnerability in the Oracle Installed Base product of Oracle E-Business Suite, specifically in the HTML UI component. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue, but successful attacks require human interaction from a user other than the attacker. While the vulnerability resides in Oracle Installed Base, exploitation can impact additional products due to a scope change. Successful attacks can result in unauthorized create, update, or delete access to some Oracle Installed Base data and unauthorized read access to a subset of that data.

Critical Impact
Exploitation permits limited unauthorized read and modification of Oracle Installed Base data and can affect additional products through scope change, contingent on user interaction.

Affected Products

Oracle E-Business Suite - Oracle Installed Base version 12.2.3
Oracle E-Business Suite - Oracle Installed Base versions 12.2.4 through 12.2.12
Oracle E-Business Suite - Oracle Installed Base version 12.2.13

Discovery Timeline

2024-02-17 - CVE-2024-20941 published to NVD
2026-06-17 - Last updated in NVD database

Oracle addressed the vulnerability in the Oracle Critical Patch Update January 2024.

Technical Details for CVE-2024-20941

Vulnerability Analysis

The vulnerability resides in the HTML UI component of Oracle Installed Base, part of Oracle E-Business Suite. The associated CWE mapping includes [CWE-125] (Out-of-bounds Read) alongside an NVD-CWE-noinfo classification. The flaw is network-reachable over HTTP and does not require authentication, but it does require a targeted user to interact with attacker-supplied content. Because the attack causes a scope change, successful exploitation can influence resources beyond the vulnerable component itself. Impact is limited to partial confidentiality and integrity loss; availability is not affected.

Root Cause

Oracle has not disclosed low-level implementation details for CVE-2024-20941. Public information indicates the defect lives in the HTML UI code path of Oracle Installed Base, where request handling permits an unauthenticated actor to influence data operations when a legitimate user interacts with crafted content. The CWE-125 mapping suggests improper bounds handling within the affected UI logic.

Attack Vector

An unauthenticated remote attacker delivers a crafted HTTP request or URL to a valid Oracle E-Business Suite user. When the user interacts with the payload, for example by loading a malicious link within an authenticated browser session, the request executes actions against the Installed Base HTML UI. The scope change indicates the attacker can reach data or functionality belonging to other Oracle E-Business Suite modules through the same session context.

No public proof-of-concept exploit is available for CVE-2024-20941. Refer to the Oracle Critical Patch Update January 2024 for vendor-provided remediation guidance.

Detection Methods for CVE-2024-20941

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE operations against Oracle Installed Base tables originating from HTML UI sessions.
HTTP requests to Oracle E-Business Suite Installed Base endpoints containing unusual query parameters or referrers from external domains.
Concurrent program executions or data changes attributable to sessions that also loaded externally hosted content.

Detection Strategies

Enable and review Oracle E-Business Suite audit trail (FND_LOGINS, page access tracking) for anomalous Installed Base activity.
Correlate web server access logs for Oracle HTTP Server with authenticated session IDs to identify cross-origin request patterns preceding data changes.
Alert on scope-changing requests where the same session touches Installed Base and unrelated E-Business Suite modules in rapid succession.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and Oracle HTTP Server logs to a centralized analytics platform for cross-source correlation.
Baseline normal Installed Base HTML UI usage per user and role, then alert on deviations such as off-hours activity or unusual client user agents.
Monitor outbound HTTP referrers reaching Oracle E-Business Suite endpoints to identify potential social-engineering delivery vectors.

How to Mitigate CVE-2024-20941

Immediate Actions Required

Apply the Oracle Critical Patch Update January 2024 for Oracle E-Business Suite Installed Base on all instances running versions 12.2.3 through 12.2.13.
Inventory Oracle E-Business Suite deployments and confirm patch status against Oracle My Oracle Support advisories.
Educate Installed Base users on phishing risks, since exploitation requires user interaction with attacker-supplied content.

Patch Information

Oracle released fixes as part of the Critical Patch Update January 2024. Administrators should follow the guidance in the Oracle Critical Patch Update January 2024 advisory and apply the vendor-supplied patches to Oracle E-Business Suite Installed Base versions 12.2.3 through 12.2.13.

Workarounds

Restrict network exposure of Oracle E-Business Suite HTML UI endpoints to trusted user networks and VPN access only.
Enforce browser isolation or web filtering for accounts with access to Oracle E-Business Suite to limit exposure to malicious external links.
Apply strict Content Security Policy and same-site cookie configurations on the Oracle HTTP Server fronting E-Business Suite where supported.

bash

# Verify Oracle E-Business Suite Installed Base patch level
# (run on the application tier as the applmgr user)
sqlplus apps/<password> <<'EOF'
SELECT bug_number, last_update_date
FROM   ad_bugs
WHERE  bug_number IN ('<CPUJAN2024_BUG_ID>')
ORDER  BY last_update_date DESC;
EOF