CVE-2024-21045: Oracle CMRO Authentication Bypass Vulnerability

CVE-2024-21045 Overview

CVE-2024-21045 affects the Oracle Complex Maintenance, Repair, and Overhaul (CMRO) product within Oracle E-Business Suite. The vulnerability resides in the List of Values (LOV) component across supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access over HTTP can exploit the flaw, though successful exploitation requires user interaction from a victim other than the attacker. The vulnerability introduces a scope change, meaning exploitation can impact products beyond CMRO itself. Oracle disclosed the issue in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation allows unauthorized read access to a subset of CMRO data and unauthorized update, insert, or delete access to additional CMRO-accessible data, with potential impact across other Oracle E-Business Suite components.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul version 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul version 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21045 published to the National Vulnerability Database
April 2024 - Oracle released a security patch via the Oracle Critical Patch Update April 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21045

Vulnerability Analysis

The vulnerability affects the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV components in Oracle E-Business Suite render dropdown or search-driven selectors used across forms and workflows. The flaw allows an unauthenticated remote attacker to craft a malicious request or link that, when activated by an authenticated user, triggers unauthorized actions in the context of that user. Because the vulnerability causes a scope change, the impact can extend beyond CMRO to other integrated Oracle E-Business Suite components. Oracle has not published detailed technical internals, and the CWE is listed as NVD-CWE-noinfo.

Root Cause

Oracle has not disclosed the specific root cause. Based on the attack characteristics requiring user interaction and producing a scope change, the issue is consistent with a client-side injection or request-forgery weakness in the LOV component. Review the Oracle Critical Patch Update April 2024 advisory for official vendor information.

Attack Vector

An attacker delivers a crafted URL or payload targeting the LOV component. A legitimate user with an active CMRO session must interact with the malicious content, for example by clicking a link or loading an attacker-controlled page. Once triggered, the request executes in the victim's session context, enabling unauthorized read, insert, update, or delete operations against CMRO-accessible data. The scope change expands potential impact to data owned by other integrated E-Business Suite modules.

No verified proof-of-concept code is publicly available for CVE-2024-21045.
See the Oracle Critical Patch Update April 2024 advisory for vendor guidance.

Detection Methods for CVE-2024-21045

Indicators of Compromise

Unexpected HTTP requests targeting LOV endpoints within the CMRO module originating from external referrers
Audit log entries showing data modifications in CMRO tables that do not correlate with legitimate user workflows
Session activity where privileged user actions follow immediately after external link clicks or email-sourced navigation

Detection Strategies

Inspect web server and application logs for anomalous LOV-related URL parameters within Oracle E-Business Suite request paths
Correlate HTTP referrer headers with internal application origins to identify cross-origin interactions targeting CMRO
Compare pre- and post-patch request patterns to identify requests that bypass expected validation controls

Monitoring Recommendations

Enable Oracle E-Business Suite auditing on CMRO tables to capture insert, update, and delete operations with user and session attribution
Forward application and database audit logs to a centralized analytics platform for behavioral baselining
Alert on authenticated sessions performing data modifications shortly after loading external content or responding to unsolicited links

How to Mitigate CVE-2024-21045

Immediate Actions Required

Apply the Oracle Critical Patch Update released in April 2024 to all CMRO deployments running versions 12.2.3 through 12.2.13
Inventory Oracle E-Business Suite environments to confirm which instances include the CMRO module and LOV component
Communicate phishing and link-handling guidance to CMRO users, since exploitation requires victim interaction

Patch Information

Oracle addressed CVE-2024-21045 in the April 2024 Critical Patch Update. Administrators should download and apply the fixes referenced in the Oracle Critical Patch Update April 2024 advisory. Follow Oracle's documented procedure for E-Business Suite patch application, including backup, test environment validation, and post-patch verification.

Workarounds

Restrict network access to Oracle E-Business Suite interfaces using firewall rules or reverse proxy controls where business workflows allow
Enforce strict Content Security Policy and SameSite cookie settings on the application tier to limit cross-origin exploitation
Disable or restrict access to the CMRO module for users who do not require it until patching is complete

bash

# Verify installed Oracle E-Business Suite patch level before and after update
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
FROM apps.ad_bugs
WHERE bug_number IN ('<cpu_apr_2024_patch_id>')
ORDER BY last_update_date DESC;
EXIT;
EOF