CVE-2024-20951: Oracle Customer Interaction History Auth Bypass

CVE-2024-20951 Overview

CVE-2024-20951 is a vulnerability in the Oracle Customer Interaction History product within Oracle E-Business Suite, specifically affecting the Outcome-Result component. The flaw impacts supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires user interaction from a victim other than the attacker. The vulnerability involves a scope change, meaning attacks may affect additional products beyond Oracle Customer Interaction History. Oracle addressed this issue in the January 2024 Critical Patch Update.

Critical Impact
Successful exploitation allows unauthorized update, insert, or delete access to Oracle Customer Interaction History data, along with unauthorized read access to a subset of that data.

Affected Products

Oracle Customer Interaction History 12.2.3
Oracle Customer Interaction History versions 12.2.4 through 12.2.12
Oracle Customer Interaction History 12.2.13

Discovery Timeline

2024-01-16 - Oracle releases fix in the January 2024 Critical Patch Update
2024-02-17 - CVE-2024-20951 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20951

Vulnerability Analysis

The vulnerability resides in the Outcome-Result component of Oracle Customer Interaction History, part of Oracle E-Business Suite. Oracle classifies the issue under [CWE-284: Improper Access Control]. The attack path traverses the network over HTTP and does not require authentication, lowering the barrier for exploitation.

Exploitation requires human interaction from a user other than the attacker. This pattern is consistent with client-side attack vectors such as crafted links or malicious content rendered in an authenticated user's browser session. Because the vulnerability introduces a scope change, the impact can extend beyond Customer Interaction History into other components accessible through the shared session or trust boundary.

Successful exploitation yields limited confidentiality impact through unauthorized read access to a subset of data, and limited integrity impact through unauthorized update, insert, or delete operations. Availability is not affected.

Root Cause

The root cause is improper access control within the Outcome-Result component. The application does not sufficiently validate authorization boundaries when processing requests that involve user interaction, allowing an external attacker to induce a legitimate user into performing actions that alter or expose data across product boundaries.

Attack Vector

An unauthenticated attacker delivers a crafted HTTP payload or link to an authenticated Oracle E-Business Suite user. When the victim interacts with the malicious content, the request executes in the victim's authenticated context. The scope change indicates that resulting operations may affect additional Oracle products beyond Customer Interaction History. No verified public exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Oracle Critical Patch Update January 2024 advisory for authoritative technical details.

Detection Methods for CVE-2024-20951

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite Customer Interaction History endpoints referencing the Outcome-Result component from external referrers.
Unauthorized inserts, updates, or deletes recorded in Customer Interaction History audit tables outside normal business workflows.
Application logs showing user-triggered actions immediately following clicks on external links or received messages.

Detection Strategies

Review Oracle E-Business Suite access logs for anomalous HTTP requests targeting Customer Interaction History URLs, particularly those originating from off-domain referrers.
Correlate database change auditing with user session logs to identify unauthorized data modifications tied to interactive user sessions.
Baseline normal Customer Interaction History transaction volume and alert on outliers indicating scripted or induced activity.

Monitoring Recommendations

Enable Oracle E-Business Suite audit trails for Customer Interaction History tables and forward events to a centralized SIEM.
Monitor web application firewall logs for HTTP requests containing suspicious parameters targeting the Outcome-Result component.
Track authenticated session activity for behavioral anomalies such as rapid multi-record modifications following inbound link clicks.

How to Mitigate CVE-2024-20951

Immediate Actions Required

Apply the Oracle January 2024 Critical Patch Update to all Oracle E-Business Suite instances running Customer Interaction History versions 12.2.3 through 12.2.13.
Inventory all Oracle E-Business Suite deployments to confirm patch coverage across production, staging, and disaster recovery environments.
Notify Oracle E-Business Suite users of the risk of clicking untrusted links while authenticated to the application.

Patch Information

Oracle released the fix in the January 2024 Critical Patch Update. Administrators should follow the guidance in the Oracle Critical Patch Update January 2024 advisory to identify the correct patch bundle for their deployed version.

Workarounds

Restrict network access to Oracle E-Business Suite interfaces using a web application firewall or reverse proxy that filters unexpected external requests.
Enforce strict browser session isolation and require users to log out of Oracle E-Business Suite when not actively working.
Deploy content security controls and email link scanning to reduce the likelihood of users interacting with attacker-supplied URLs.

bash

# Verify installed Oracle E-Business Suite patch level
# Refer to Oracle documentation for the exact query for your environment
sqlplus apps/<password> @$AD_TOP/patch/115/sql/adpatchlist.sql