CVE-2024-20991: Oracle HTTP Server Information Disclosure

CVE-2024-20991 Overview

CVE-2024-20991 is an information disclosure vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware. The flaw resides in the Web Listener subcomponent and affects version 12.2.1.4.0. An unauthenticated attacker with network access over HTTP can exploit the vulnerability to read a subset of data accessible to Oracle HTTP Server. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can obtain unauthorized read access to a subset of data exposed by Oracle HTTP Server over the network.

Affected Products

Oracle HTTP Server 12.2.1.4.0
Oracle Fusion Middleware (Web Listener component)
Deployments exposing Oracle HTTP Server over HTTP to untrusted networks

Discovery Timeline

2024-04-16 - CVE-2024-20991 published to NVD
2024-04-16 - Oracle publishes April 2024 Critical Patch Update advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20991

Vulnerability Analysis

The vulnerability resides in the Web Listener component of Oracle HTTP Server, the front-end HTTP request handler for Oracle Fusion Middleware. Oracle describes the flaw as easily exploitable by an unauthenticated attacker with network access over HTTP. Successful exploitation results in unauthorized read access to a subset of data accessible through Oracle HTTP Server.

The impact is limited to confidentiality. Integrity and availability are not affected, and privilege scope does not change during exploitation. The issue is classified under CWE-200, which covers exposure of sensitive information to unauthorized actors.

Oracle's advisory does not publish exploit primitives. No public proof-of-concept, Exploit-DB entry, or CISA KEV listing exists for this CVE at the time of writing.

Root Cause

The root cause lies in how the Web Listener component handles specific HTTP requests, permitting an unauthenticated client to reach data that should not be exposed. Oracle has not disclosed further internal detail beyond the advisory description. Refer to the Oracle April 2024 Critical Patch Update for vendor-authoritative information.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker requires no authentication, no user interaction, and no elevated privileges. Any Oracle HTTP Server 12.2.1.4.0 instance reachable from an untrusted network segment is in scope. Because impact is confined to partial confidentiality loss, this vulnerability is more suited to reconnaissance or targeted data harvesting than to full system compromise.

No verified exploitation code is available. Refer to the vendor advisory for remediation guidance.

Detection Methods for CVE-2024-20991

Indicators of Compromise

Anomalous HTTP request patterns to Oracle HTTP Server endpoints from unfamiliar source IPs.
Unexpected HTTP responses that include configuration data, header content, or server-side metadata not intended for public consumption.
Repeated probing requests targeting the Web Listener at unusual request rates or with malformed headers.

Detection Strategies

Inventory Oracle Fusion Middleware deployments and identify hosts running Oracle HTTP Server 12.2.1.4.0.
Deploy authenticated vulnerability scanning that maps against Oracle's April 2024 CPU advisory identifiers.
Inspect web server access logs for reconnaissance patterns targeting Web Listener endpoints from external sources.

Monitoring Recommendations

Forward Oracle HTTP Server access and error logs to a centralized SIEM or data lake for retention and correlation.
Alert on response payloads that exceed expected sizes for public endpoints, which can indicate unintended data exposure.
Baseline normal HTTP request patterns for Oracle HTTP Server and alert on statistical deviations, particularly on requests originating from outside expected client networks.

How to Mitigate CVE-2024-20991

Immediate Actions Required

Apply the fixes provided in the Oracle April 2024 Critical Patch Update to all affected Oracle HTTP Server 12.2.1.4.0 instances.
Restrict network access to Oracle HTTP Server management and administrative interfaces to trusted segments only.
Review web server logs for indicators of prior reconnaissance targeting the Web Listener component.

Patch Information

Oracle addressed CVE-2024-20991 in the April 2024 Critical Patch Update. Administrators should download and apply the patch bundle referenced in the Oracle April 2024 Security Alert. Verify the patch level on affected hosts after installation and confirm that 12.2.1.4.0 deployments reflect the updated release notes.

Workarounds

Place Oracle HTTP Server behind a reverse proxy or web application firewall configured to filter unexpected request patterns.
Limit inbound HTTP exposure using network access control lists until patching is complete.
Disable unused Oracle HTTP Server modules and endpoints to reduce the attack surface exposed by the Web Listener component.

bash

# Example: restrict inbound HTTP access to Oracle HTTP Server at the host firewall
# Replace <trusted_cidr> with the CIDR range permitted to reach the service
iptables -A INPUT -p tcp --dport 80 -s <trusted_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP