CVE-2024-21038: Oracle CMRO Authentication Bypass Vulnerability

CVE-2024-21038 Overview

CVE-2024-21038 affects the Oracle Complex Maintenance, Repair, and Overhaul (cMRO) product within Oracle E-Business Suite. The flaw resides in the List of Values (LOV) component and impacts supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access over HTTP can exploit the issue, but successful exploitation requires user interaction from a victim other than the attacker. Because the scope changes, attacks can affect components beyond cMRO itself, including unauthorized read, insert, update, and delete access to a subset of application data. Oracle addressed the vulnerability in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation grants attackers unauthorized read access and limited write access to cMRO data, with scope change extending impact to other integrated Oracle products.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul version 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul version 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21038 published to NVD and disclosed in Oracle's April 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21038

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul, a module within Oracle E-Business Suite that supports asset-intensive maintenance operations. The LOV component typically renders selectable value pickers used by other application screens, meaning tainted output from LOV can propagate across the broader E-Business Suite experience.

According to Oracle's advisory, exploitation requires human interaction from a user other than the attacker. This pattern is characteristic of client-side injection or redirection weaknesses, where an attacker crafts a request or link that a legitimate user must click or render. The scope change in the CVSS vector indicates that components beyond cMRO can be affected when the vulnerability is triggered.

NVD classifies the weakness as NVD-CWE-noinfo, meaning Oracle did not disclose the specific weakness class.

Root Cause

Oracle has not published root-cause details beyond identifying the LOV component as the vulnerable surface. The requirement for user interaction combined with scope change strongly suggests improper handling of attacker-controlled input rendered in a context trusted by other E-Business Suite modules.

Attack Vector

The attack vector is network-based over HTTP and does not require authentication. The attacker must deliver a malicious payload or link to an authenticated E-Business Suite user, who then interacts with the LOV component. On successful exploitation, the attacker gains limited unauthorized read, insert, update, or delete access to data accessible by cMRO, with impact crossing scope boundaries into other Oracle components.

No verified proof-of-concept code is publicly available for CVE-2024-21038.
Refer to the Oracle April 2024 Critical Patch Update advisory for technical details.

Detection Methods for CVE-2024-21038

Indicators of Compromise

Unexpected HTTP requests targeting LOV endpoints within Oracle E-Business Suite cMRO modules from external or unauthenticated sources.
Anomalous reflected parameter values in LOV-related URLs delivered to authenticated users through email, chat, or external links.
Database audit entries showing unauthorized INSERT, UPDATE, or DELETE activity against cMRO tables correlated with suspicious user sessions.

Detection Strategies

Enable Oracle E-Business Suite application-tier access logging and correlate LOV request patterns against expected business workflows.
Deploy a web application firewall rule set to inspect query parameters sent to Oracle Application Framework LOV handlers for suspicious payloads.
Review Oracle audit trail (FND_LOG_MESSAGES, FND_UNSUCCESSFUL_LOGINS) for anomalous data modifications tied to cMRO responsibilities.

Monitoring Recommendations

Monitor outbound links in emails that reference Oracle E-Business Suite host names to identify potential social-engineering lures.
Track user interaction patterns on cMRO LOV screens, flagging sessions where parameters originate from external referrers.
Alert on scope-crossing data access patterns where cMRO sessions touch unrelated E-Business Suite modules in short time windows.

How to Mitigate CVE-2024-21038

Immediate Actions Required

Apply the April 2024 Oracle Critical Patch Update to all Oracle E-Business Suite environments running cMRO versions 12.2.3 through 12.2.13.
Inventory all Oracle E-Business Suite instances to confirm cMRO is patched, including development, test, and disaster-recovery systems.
Review user responsibilities assigned to cMRO and remove unnecessary access to reduce the pool of potential victims.

Patch Information

Oracle released a fix for CVE-2024-21038 in the April 2024 Critical Patch Update. Administrators should consult the Oracle Security Advisory: April 2024 for patch identifiers specific to their deployed version. No official workaround exists, so patching remains the authoritative remediation.

Workarounds

Restrict network access to Oracle E-Business Suite application tiers so that only trusted corporate networks and VPN clients can reach LOV endpoints.
Deploy a reverse proxy or web application firewall in front of E-Business Suite to filter malformed or externally sourced LOV parameters.
Train cMRO users to avoid clicking Oracle E-Business Suite links received from untrusted sources until patches are applied.

bash

# Example: restrict external access to Oracle E-Business Suite LOV endpoints at the reverse proxy
location ~* /OA_HTML/.*lov {
    allow 10.0.0.0/8;        # internal corporate network
    allow 192.168.0.0/16;    # VPN range
    deny all;
    proxy_pass http://ebs-app-tier;
}