CVE-2024-20950: Oracle Customer Interaction History Bypass

CVE-2024-20950 Overview

CVE-2024-20950 affects the Oracle Customer Interaction History product within Oracle E-Business Suite, specifically the Outcome-Result component. The flaw impacts supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue when a legitimate user is tricked into interacting with attacker-controlled content. Successful exploitation allows unauthorized read, insert, update, or delete access to a subset of application data, with a scope change that may impact additional Oracle products.

Critical Impact
Remote unauthenticated attackers can compromise data integrity and confidentiality in Oracle Customer Interaction History, with scope-changing effects that may reach adjacent Oracle E-Business Suite components.

Affected Products

Oracle Customer Interaction History 12.2.3
Oracle Customer Interaction History versions 12.2.4 through 12.2.12
Oracle Customer Interaction History 12.2.13

Discovery Timeline

2024-01-16 - Oracle publishes Critical Patch Update advisory addressing CVE-2024-20950
2024-01-16 - CVE-2024-20950 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20950

Vulnerability Analysis

The vulnerability resides in the Outcome-Result component of Oracle Customer Interaction History. An unauthenticated remote attacker sends a crafted HTTP request that requires interaction from an authenticated user other than the attacker. The scope change indicator in the CVSS vector means impact extends beyond Oracle Customer Interaction History to other products within the Oracle E-Business Suite deployment. NVD categorizes this issue under [NVD-CWE-noinfo] because Oracle does not disclose specific weakness details in Critical Patch Updates. Based on the required user interaction and scope change, the flaw is consistent with a client-side injection class such as Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) in the web-facing Outcome-Result functionality.

Root Cause

Oracle does not publish detailed root-cause information for CPU-tracked vulnerabilities. The advisory attributes the flaw to the Outcome-Result subcomponent of Oracle Customer Interaction History. The behavior — network attack vector, no privileges required, user interaction required, and scope change — indicates insufficient validation or sanitization of attacker-controlled input rendered or processed in a trusted context within the E-Business Suite web tier.

Attack Vector

Exploitation proceeds over HTTP against exposed Oracle E-Business Suite endpoints. The attacker crafts a malicious link, form, or payload targeting the Outcome-Result component. A privileged user of Oracle Customer Interaction History must interact with the crafted content, for example by visiting a link while authenticated. The attacker then performs unauthorized read, insert, update, or delete operations against data accessible to the victim session, and the impact may cross into additional Oracle E-Business Suite products due to the scope change.

No verified public proof-of-concept code exists for this vulnerability. Refer to the Oracle Critical Patch Update January 2024 advisory for vendor-provided technical guidance.

Detection Methods for CVE-2024-20950

Indicators of Compromise

Unusual HTTP requests to Oracle Customer Interaction History endpoints containing script fragments, encoded payloads, or unexpected redirect parameters targeting the Outcome-Result component.
Authenticated user sessions performing insert, update, or delete operations on Customer Interaction History records shortly after clicking external links or opening email content.
Cross-application data modifications in Oracle E-Business Suite that originate from a Customer Interaction History session context.

Detection Strategies

Inspect web-tier access logs for requests to Customer Interaction History URLs that carry suspicious query parameters, HTML entities, or JavaScript event handlers.
Correlate user interaction events (such as link clicks in mail gateways) with subsequent privileged actions in Oracle E-Business Suite.
Deploy web application firewall rules that flag HTTP requests matching XSS and CSRF signatures against E-Business Suite endpoints.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database audit, and web server logs to a centralized analytics platform for correlation and retention.
Baseline expected traffic to the Customer Interaction History module and alert on deviations in request rate, source geography, or referrer.
Track privileged user sessions in E-Business Suite and alert when data-modifying actions follow known phishing indicators.

How to Mitigate CVE-2024-20950

Immediate Actions Required

Apply the January 2024 Oracle Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.13.
Inventory internet-exposed Oracle E-Business Suite instances and restrict external access to the Customer Interaction History module where feasible.
Notify users of Oracle Customer Interaction History about the risk of clicking untrusted links while authenticated to the application.

Patch Information

Oracle addressed CVE-2024-20950 in the Critical Patch Update released on January 16, 2024. Administrators must download and apply the relevant patch set for Oracle E-Business Suite 12.2 as documented in the Oracle Critical Patch Update January 2024 advisory. Oracle strongly recommends applying CPU fixes as soon as possible because unpatched Oracle installations have been targeted historically.

Workarounds

Enforce strict Content Security Policy (CSP) headers on the E-Business Suite web tier to limit script execution contexts.
Restrict access to the Oracle E-Business Suite web tier to trusted networks using VPN or reverse proxy access controls until patching is complete.
Require users to log out of Oracle E-Business Suite when not actively working to reduce the window for user-interaction-based attacks.

bash

# Configuration example
# Restrict Oracle E-Business Suite web tier to internal networks (example iptables rule)
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP