CVE-2024-21029: Oracle CMRO Authentication Bypass Flaw

CVE-2024-21029 Overview

CVE-2024-21029 is a vulnerability in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of the Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though successful attacks require user interaction from a person other than the attacker. Exploitation results in a scope change, meaning attacks originating in this component may impact additional Oracle products. Successful attacks can lead to unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete operations against a limited data set.

Critical Impact
An unauthenticated remote attacker can leverage user interaction to compromise data integrity and confidentiality across products connected to Oracle Complex Maintenance, Repair, and Overhaul.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21029 published to the National Vulnerability Database
April 2024 - Oracle addressed the issue in the Oracle April 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21029

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV components render selectable value pickers used throughout Oracle E-Business Suite forms and self-service pages. The flaw is reachable over HTTP by an unauthenticated attacker but requires interaction from a legitimate user to complete exploitation. Because the vulnerability causes a scope change, the effect extends beyond the vulnerable component to additional Oracle products that share the same security authority. The Common Weakness Enumeration for this issue is listed as [NVD-CWE-noinfo], reflecting the limited technical detail released by Oracle in the Critical Patch Update advisory.

Root Cause

Oracle has not published the underlying defect class in the public advisory. The exploitation pattern — network attack, no privileges required, required user interaction, and a scope change — is consistent with client-side injection or request-forgery style flaws in LOV rendering or parameter handling. Refer to Oracle's advisory for authoritative remediation guidance.

Attack Vector

An attacker crafts a malicious HTTP request or link targeting the LOV component and induces an authenticated Oracle E-Business Suite user to trigger it, typically through phishing or a compromised web page. The victim's session provides the execution context needed to reach adjacent Oracle products across the scope change boundary. No verified public exploit code is available, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept is available for this CVE. See the Oracle April 2024 Critical Patch Update for authoritative technical details.

Detection Methods for CVE-2024-21029

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite LOV endpoints containing unusual query parameters or encoded payloads.
Outbound HTTP referrers from unfamiliar external domains that direct authenticated users into OA.jsp or LOV form URLs.
Unauthorized modifications to records in Oracle Complex Maintenance, Repair, and Overhaul tables lacking a corresponding user workflow.

Detection Strategies

Inspect Oracle HTTP Server and WebLogic access logs for anomalous LOV requests originating from newly seen client fingerprints or referrers.
Correlate application-tier audit records with database change logs to spot writes that bypass expected form flows.
Alert on session tokens used from multiple source IP addresses within short time windows, which may indicate hijacked interaction.

Monitoring Recommendations

Enable Oracle E-Business Suite auditing on Complex Maintenance, Repair, and Overhaul modules and forward logs to a centralized SIEM.
Baseline normal LOV request volume per user and alert on statistical deviations.
Monitor cross-product access following LOV interactions to catch behavior consistent with the CVSS scope change.

How to Mitigate CVE-2024-21029

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update to all Oracle E-Business Suite 12.2.x environments running Complex Maintenance, Repair, and Overhaul.
Inventory all EBS instances, including test and staging systems, and confirm the patch level covers CVE-2024-21029.
Notify end users of the ongoing risk from clicking untrusted links that lead to EBS URLs while authenticated.

Patch Information

Oracle released the fix as part of the Oracle April 2024 Critical Patch Update. Administrators should follow the CPU advisory to identify the specific patch identifier for Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13 and apply it during a scheduled maintenance window.

Workarounds

Restrict network access to Oracle E-Business Suite endpoints using a VPN, reverse proxy allowlist, or web application firewall until patching is complete.
Enforce strict Referer and Origin header validation at the edge to reduce the reliability of user-interaction-based attacks against LOV endpoints.
Increase user awareness training focused on phishing links that target internal enterprise applications.

bash

# Example WAF rule concept to restrict LOV endpoint access to internal networks
# Adjust for your reverse proxy or WAF vendor syntax
location ~* /OA_HTML/.*LOV.* {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}