CVE-2024-21037: Oracle CMRO Authentication Bypass Vulnerability

CVE-2024-21037 Overview

CVE-2024-21037 affects the Oracle Complex Maintenance, Repair, and Overhaul product within Oracle E-Business Suite. The flaw resides in the List of Values (LOV) component and impacts supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access over HTTP can exploit the issue, though successful exploitation requires interaction from a user other than the attacker. The vulnerability introduces a scope change, meaning exploitation can affect resources beyond the vulnerable component. Oracle addressed the flaw in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation grants unauthorized read access to a subset of application data and unauthorized update, insert, or delete access to some accessible data, with impact extending to additional products due to scope change.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul version 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul version 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21037 published to NVD following Oracle's April 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21037

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV components render selectable option lists in Oracle E-Business Suite forms and are frequently reachable through HTTP-facing servlets. The flaw allows an unauthenticated remote attacker to craft input that, when processed after user interaction, results in unauthorized data access and modification. Oracle characterizes the issue with a scope change, indicating the vulnerable component can influence data or functionality outside its own security boundary. The National Vulnerability Database lists the weakness as [NVD-CWE-noinfo], as Oracle did not publish a precise weakness classification.

Root Cause

Oracle has not disclosed the specific defect in the LOV component. The behavior — unauthenticated network reach combined with user interaction and cross-component impact — is consistent with client-side injection or reflected input handling flaws in web-facing LOV endpoints. Confirmatory technical details are limited to Oracle's Critical Patch Update advisory.

Attack Vector

An attacker delivers a crafted HTTP request or URL to a target user, typically an authenticated E-Business Suite operator. When the victim interacts with the malicious content, the LOV component processes attacker-controlled input in the victim's session context. The resulting actions can read a subset of application data and perform unauthorized insert, update, or delete operations. Because the vulnerability has scope change, effects can extend beyond Oracle Complex Maintenance, Repair, and Overhaul into other Oracle E-Business Suite components accessible through the shared session.

No public proof-of-concept code has been released. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and carries an EPSS score of 0.382%.

Detection Methods for CVE-2024-21037

Indicators of Compromise

Unexpected HTTP requests to LOV-related endpoints under /OA_HTML/ referencing Complex Maintenance, Repair, and Overhaul modules
Anomalous insert, update, or delete operations in CMRO tables originating from user sessions that only performed read workflows
Outbound links or email attachments coaxing E-Business Suite users into clicking Oracle application URLs with unusual query parameters

Detection Strategies

Correlate web server access logs for LOV servlet calls against the corresponding database write operations performed under the same session identifier
Baseline normal LOV query parameters per role and alert on parameter values containing script markup, encoded payloads, or references to unrelated modules
Monitor Oracle E-Business Suite audit trails (FND_LOG_MESSAGES, application audit tables) for privilege usage inconsistent with user job function

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record user navigation into CMRO LOV pages
Forward web tier and database audit logs to a centralized analytics platform for cross-source correlation
Alert on user-interaction-driven anomalies such as CMRO actions immediately following inbound email link clicks recorded by mail gateways

How to Mitigate CVE-2024-21037

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update April 2024 to all affected Oracle E-Business Suite 12.2 environments
Inventory all instances running Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13 and prioritize internet-exposed deployments
Brief E-Business Suite users on phishing risks that target authenticated application sessions, since exploitation requires user interaction

Patch Information

Oracle released a fix as part of the Oracle Critical Patch Update April 2024. Administrators should follow Oracle's E-Business Suite patching guidance, apply the referenced CPU patches to the technology stack and CMRO product, and validate patch installation using Oracle's post-install verification scripts.

Workarounds

Restrict network exposure of Oracle E-Business Suite so LOV endpoints are reachable only from trusted networks or via VPN
Deploy a web application firewall in front of the E-Business Suite web tier with rules blocking script markup and encoded payloads in LOV query parameters
Disable or restrict access to CMRO responsibilities for users who do not require them until patching is complete

bash

# Example: apply Oracle E-Business Suite CPU patch using adop
adop phase=apply patches=<CPU_APR_2024_PATCH_ID> workers=8
adop phase=finalize,cutover,cleanup