CVE-2024-21074: Oracle Trade Management Auth Bypass Flaw

CVE-2024-21074 Overview

CVE-2024-21074 is a high-severity vulnerability in the Oracle Trade Management product of Oracle E-Business Suite, specifically within the Finance LOV component. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated remote attacker with network access via HTTP can exploit the issue without user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. Oracle addressed the issue in the April 2024 Critical Patch Update. The vulnerability is categorized under CWE-284: Improper Access Control.

Critical Impact
An unauthenticated network attacker can read sensitive Oracle Trade Management data over HTTP, leading to full confidentiality compromise of the affected module.

Affected Products

Oracle E-Business Suite — Oracle Trade Management 12.2.3
Oracle E-Business Suite — Oracle Trade Management versions 12.2.4 through 12.2.12
Oracle E-Business Suite — Oracle Trade Management 12.2.13

Discovery Timeline

2024-04-16 - Oracle published the security alert as part of the April 2024 Critical Patch Update
2024-04-16 - CVE-2024-21074 published to NVD
2025-05-08 - Last updated in NVD database

Technical Details for CVE-2024-21074

Vulnerability Analysis

The vulnerability resides in the Finance LOV (List of Values) component of Oracle Trade Management. An attacker can issue crafted HTTP requests to the affected endpoint without supplying credentials. The server processes those requests and returns data that should be access-restricted. Because the flaw impacts confidentiality only, integrity and availability of the application remain intact during exploitation. The issue exposes business-critical financial data managed by the Trade Management module, including channel funds, accruals, and settlement details handled through Finance LOV.

The Exploit Prediction Scoring System places CVE-2024-21074 in a higher exploitation-likelihood range relative to most CVEs, reflecting the network-reachable, unauthenticated nature of the bug. No public proof-of-concept exploit or CISA KEV listing is currently associated with the CVE.

Root Cause

The root cause is improper access control [CWE-284] in the Finance LOV component. The application fails to enforce authentication or authorization checks before returning data through the affected list-of-values interface. As a result, the server-side handler honors requests from anonymous clients and discloses records that should require an authenticated Oracle E-Business Suite session.

Attack Vector

Exploitation requires only network access to the Oracle E-Business Suite HTTP listener exposing the Trade Management module. The attacker sends HTTP requests targeting the Finance LOV endpoint. No prior authentication, user interaction, or elevated privileges are needed. Internet-exposed Oracle E-Business Suite deployments are at the highest risk, but internal attackers with HTTP access to the application tier can also reach the vulnerable component.

No verified exploit code is publicly available. Refer to the Oracle Security Alert April 2024 for vendor-supplied technical context.

Detection Methods for CVE-2024-21074

Indicators of Compromise

Unauthenticated HTTP requests targeting Oracle Trade Management Finance LOV URLs in application-tier access logs.
Anomalously large HTTP response payloads returned from Trade Management LOV endpoints to external or unexpected source addresses.
Repeated enumeration patterns against /OA_HTML/ paths associated with Oracle Trade Management on E-Business Suite hosts.

Detection Strategies

Inventory all Oracle E-Business Suite 12.2.x deployments and confirm whether the Oracle Trade Management module is licensed and enabled.
Review Oracle HTTP Server and reverse proxy logs for requests to Finance LOV endpoints lacking valid session cookies or ICX tokens.
Correlate unauthenticated traffic to Trade Management with external IP reputation data to identify reconnaissance against the application tier.

Monitoring Recommendations

Enable verbose logging on the Oracle E-Business Suite application tier and forward logs to a centralized SIEM for retention and analysis.
Alert on any HTTP 200 responses from Trade Management LOV URLs that occur without a preceding authenticated session establishment.
Monitor outbound data volumes from the application server to detect bulk data extraction following suspicious LOV access.

How to Mitigate CVE-2024-21074

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update to all Oracle E-Business Suite 12.2.x environments running Trade Management.
Restrict network exposure of the Oracle E-Business Suite application tier to trusted networks and VPN-only access where feasible.
Audit access logs for the Finance LOV endpoint dating back to before patch deployment to identify potential prior exploitation.

Patch Information

Oracle released a fix for CVE-2024-21074 in the April 2024 Critical Patch Update. Administrators must apply the corresponding Oracle E-Business Suite patches for supported versions 12.2.3 through 12.2.13. Refer to the Oracle Security Alert April 2024 for patch identifiers, prerequisites, and installation guidance.

Workarounds

Block unauthenticated access to Trade Management Finance LOV URLs at the reverse proxy or Web Application Firewall layer until patching is complete.
Disable the Oracle Trade Management module if it is not actively used in the deployment.
Enforce IP allowlisting on the Oracle HTTP Server to limit which clients can reach the E-Business Suite application tier.

bash

# Example WAF rule (ModSecurity) to block unauthenticated access to Trade Management LOV endpoints
SecRule REQUEST_URI "@rx /OA_HTML/.*(ozf|ams).*LOV" \
    "id:1002104,phase:1,deny,status:403,\
    chain,msg:'Block unauthenticated Oracle Trade Management Finance LOV access (CVE-2024-21074)'"
    SecRule &REQUEST_COOKIES:ICX_SESSION "@eq 0"