CVE-2024-21042: Oracle CMRO Authentication Bypass Vulnerability

CVE-2024-21042 Overview

CVE-2024-21042 affects the List of Values (LOV) component in Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. The vulnerability affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the flaw, but successful attacks require interaction from a user other than the attacker. Oracle disclosed the issue in the April 2024 Critical Patch Update.

Successful exploitation permits unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete access to some data. The vulnerability has a scope change, meaning exploitation may significantly impact additional products beyond the vulnerable component.

Critical Impact
Unauthenticated network-based exploitation via HTTP that requires user interaction and can result in cross-product data integrity and confidentiality compromise within Oracle E-Business Suite environments.

Affected Products

Oracle E-Business Suite — Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle E-Business Suite — Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle E-Business Suite — Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes the April 2024 Critical Patch Update addressing this vulnerability
2024-04-16 - CVE-2024-21042 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21042

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV components in Oracle E-Business Suite render selectable value pickers used throughout the application interface. Oracle classifies the weakness as NVD-CWE-noinfo, meaning the specific weakness class was not disclosed in public advisories.

Exploitation requires a victim user to interact with attacker-supplied content, such as following a crafted link or loading a tampered page. Because the scope changes, the vulnerable component can affect resources managed by other Oracle E-Business Suite modules sharing the session context. The resulting impact includes partial loss of confidentiality and integrity, with no direct impact to availability.

Root Cause

Oracle has not published the specific root cause for CVE-2024-21042. The combination of required user interaction, scope change, and partial confidentiality and integrity impact is characteristic of client-side injection or request-forgery style weaknesses in web-facing LOV handlers. Oracle customers must consult My Oracle Support for detailed technical analysis.

Attack Vector

The attack is network-based over HTTP with no authentication required by the attacker. The attacker must induce a separate authenticated or interacting user to trigger the vulnerable LOV code path, typically through social engineering such as a crafted URL or embedded content. Successful exploitation then operates within the victim's session context against the Oracle E-Business Suite deployment.

No verified proof-of-concept code is publicly available. See the Oracle Critical Patch Update April 2024 for vendor-provided technical details.

Detection Methods for CVE-2024-21042

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite LOV endpoints originating from external referrers or embedded in third-party pages.
Anomalous data modification events (insert, update, delete) in Complex Maintenance, Repair, and Overhaul tables outside normal maintenance workflows.
User sessions executing LOV queries immediately after clicking externally delivered links or email content.

Detection Strategies

Review Oracle E-Business Suite application and HTTP server access logs for malformed or unusual LOV parameters.
Correlate web proxy logs with Oracle E-Business Suite session activity to identify cross-origin triggers to LOV handlers.
Enable Oracle E-Business Suite audit policies on Complex Maintenance, Repair, and Overhaul objects to capture unauthorized data changes.

Monitoring Recommendations

Monitor Oracle HTTP Server logs for spikes in LOV-related request patterns and HTTP referrer anomalies.
Track database audit records for modifications to Complex Maintenance, Repair, and Overhaul tables by interactive user sessions.
Alert on authenticated users following external links immediately before executing Oracle E-Business Suite transactions.

How to Mitigate CVE-2024-21042

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update to all Oracle E-Business Suite instances running Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13.
Inventory all Oracle E-Business Suite deployments to confirm which environments expose the Complex Maintenance, Repair, and Overhaul module.
Restrict external access to Oracle E-Business Suite interfaces to trusted networks until patches are deployed.

Patch Information

Oracle addressed CVE-2024-21042 in the Oracle Critical Patch Update April 2024. Customers must apply the Oracle E-Business Suite 12.2 patches referenced in that advisory. Oracle recommends applying Critical Patch Updates without delay, as the vendor does not provide alternative fixes for publicly disclosed vulnerabilities.

Workarounds

Enforce strict HTTP Referer and Origin validation at the perimeter for Oracle E-Business Suite URLs to limit cross-site triggering of LOV handlers.
Train users with Complex Maintenance, Repair, and Overhaul access to avoid clicking untrusted links while logged into Oracle E-Business Suite.
Place Oracle E-Business Suite behind a web application firewall with rules that inspect LOV request parameters.

bash

# Example: restrict access to Oracle E-Business Suite URLs at the reverse proxy
# Replace with the appropriate ACL for your environment
<Location /OA_HTML/>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>