CVE-2024-21035: Oracle CMRO Authentication Bypass Flaw

CVE-2024-21035 Overview

CVE-2024-21035 is a vulnerability in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. Affected versions span 12.2.3 through 12.2.13. An unauthenticated attacker with network access over HTTP can exploit the flaw, provided a user other than the attacker performs a required interaction. The vulnerability carries a scope change, meaning successful exploitation can affect components beyond the vulnerable product. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation allows unauthorized read access to a subset of data and unauthorized update, insert, or delete access to some data within Oracle Complex Maintenance, Repair, and Overhaul, with potential impact on additional products due to scope change.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - CVE CVE-2024-21035 published to NVD alongside the Oracle Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21035

Vulnerability Analysis

The flaw resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. Oracle classifies it under improper authorization [CWE-285]. An unauthenticated remote attacker can trigger the issue over HTTP, but exploitation depends on a victim user performing an action such as clicking a crafted link. The vulnerability produces a scope change, meaning the compromised component can influence resources managed by other products in the E-Business Suite stack. Confidentiality and integrity are affected at a low level, while availability is not impacted.

Root Cause

The root cause is improper authorization in the LOV component. The application does not sufficiently verify that requests performed through the LOV interface are permitted for the acting user, allowing restricted read, insert, update, or delete operations against a subset of application data.

Attack Vector

Exploitation occurs over the network using HTTP. The attacker crafts a request or link targeting the LOV component and induces an authenticated or authorized user to trigger it. Because the vulnerability carries a scope change, actions executed through the vulnerable component can affect data and functionality in related Oracle E-Business Suite modules. No authentication is required from the attacker, and attack complexity is low.

No public proof-of-concept exploit is listed in the NVD data for CVE-2024-21035, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. See the Oracle Security Alert April 2024 for Oracle's technical details.

Detection Methods for CVE-2024-21035

Indicators of Compromise

Unexpected modifications (insert, update, or delete operations) to Oracle Complex Maintenance, Repair, and Overhaul records without a corresponding authorized workflow.
HTTP requests to LOV endpoints originating from unusual referrers, external domains, or links delivered via email or chat.
Audit log entries showing data access patterns inconsistent with the acting user's normal role or responsibilities.

Detection Strategies

Review Oracle E-Business Suite application and database audit trails for LOV-related activity tied to user sessions that followed external link clicks.
Correlate web server access logs with user session data to identify crafted requests targeting LOV endpoints.
Monitor for cross-module data changes that align with the scope-change behavior described in the advisory.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to capture LOV component invocations.
Forward web tier and database audit logs to a centralized analytics platform for correlation and long-term retention.
Alert on anomalous data modification rates in Complex Maintenance, Repair, and Overhaul tables that fall outside baseline business activity.

How to Mitigate CVE-2024-21035

Immediate Actions Required

Apply the April 2024 Oracle Critical Patch Update to all affected Oracle E-Business Suite environments running Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13.
Inventory all E-Business Suite instances, including non-production, to confirm patch coverage.
Educate users on the social engineering aspect of this vulnerability, as exploitation requires user interaction via a crafted link.

Patch Information

Oracle released fixes in the April 2024 Critical Patch Update. Administrators should review the Oracle Security Alert April 2024 advisory for the applicable patch identifiers and installation instructions for each affected release in the 12.2.x branch.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier so that only trusted internal networks can reach application endpoints.
Place a web application firewall in front of the E-Business Suite environment and inspect requests targeting LOV endpoints for anomalous parameters or referrers.
Enforce strict email and web filtering to reduce the likelihood that users click attacker-supplied links required for exploitation.

bash

# Configuration example
# Oracle recommends applying the April 2024 CPU patch rather than relying on workarounds.
# See: https://www.oracle.com/security-alerts/cpuapr2024.html