CVE-2024-21075: Oracle Trade Management Info Disclosure

CVE-2024-21075 Overview

CVE-2024-21075 affects the Oracle Trade Management product within Oracle E-Business Suite, specifically the Claim Line List of Values (LOV) component. The vulnerability impacts supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this flaw without user interaction. Successful exploitation grants unauthorized read access to sensitive Oracle Trade Management data, up to complete access to all data accessible through the application. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can read all data accessible to Oracle Trade Management, exposing sensitive business and financial claim information.

Affected Products

Oracle Trade Management 12.2.3
Oracle Trade Management 12.2.4 through 12.2.12
Oracle Trade Management 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes fix in the April 2024 Critical Patch Update and CVE-2024-21075 is published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21075

Vulnerability Analysis

The vulnerability resides in the Claim Line LOV component of Oracle Trade Management, part of Oracle E-Business Suite. The flaw is remotely exploitable over HTTP without authentication or user interaction. Exploitation results in unauthorized disclosure of confidential data but does not affect data integrity or availability. Oracle classifies the issue as easily exploitable, meaning an attacker requires no specialized conditions to trigger it. The EPSS score is 0.657% with a percentile of 46.816, indicating measurable interest relative to the broader CVE population.

Root Cause

The root cause is categorized under [NVD-CWE-noinfo] because Oracle does not publish detailed technical breakdowns for E-Business Suite vulnerabilities. Based on the CVSS metrics and affected component, the flaw resides in the Claim Line List of Values (LOV) handler, which appears to return data without enforcing proper access control checks on the requesting session. LOV endpoints in Oracle E-Business Suite are commonly used to populate form fields and are accessible through HTTP requests to the application server.

Attack Vector

An attacker sends crafted HTTP requests to the Oracle Trade Management LOV endpoint exposed by the E-Business Suite web tier. Because the vulnerability requires no authentication, any actor able to reach the application over the network can query the affected component. The response leaks data belonging to the Trade Management module, which typically includes customer claims, promotions, budgets, and settlement records.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert April 2024 for vendor-provided details.

Detection Methods for CVE-2024-21075

Indicators of Compromise

Unauthenticated HTTP requests targeting Trade Management LOV endpoints such as URLs containing OKS, ozf, or ClaimLine path segments in the E-Business Suite web tier.
Unusual volumes of LOV or query responses returning large result sets to a single external IP address.
Access log entries from non-corporate IP ranges hitting Trade Management URIs outside of business hours.

Detection Strategies

Enable Oracle E-Business Suite access logging on the web tier and forward logs to a centralized analytics platform for correlation.
Alert on HTTP requests to Trade Management LOV URLs that lack a valid authenticated session cookie or ICX ticket.
Baseline normal LOV request patterns and flag statistical anomalies in request volume, response size, or source IP diversity.

Monitoring Recommendations

Monitor Oracle HTTP Server and WebLogic access logs for repeated requests to Trade Management endpoints from single sources.
Track database audit events on Trade Management schemas (OZF, AMS) for queries that return unusually large row counts.
Deploy a web application firewall in front of the E-Business Suite web tier and log all requests to /OA_HTML/ paths tied to Trade Management.

How to Mitigate CVE-2024-21075

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update to all Oracle E-Business Suite instances running Trade Management versions 12.2.3 through 12.2.13.
Inventory internet-facing E-Business Suite deployments and restrict external access to the Trade Management module until patching is complete.
Review web tier and database audit logs for suspicious access to Claim Line LOV endpoints preceding the patch date.

Patch Information

Oracle released the fix as part of the April 2024 Critical Patch Update. Administrators must apply the E-Business Suite 12.2 patch set documented in the Oracle Security Alert April 2024. Follow Oracle's standard EBS patching procedure using adop and validate the Trade Management module functions after deployment.

Workarounds

Restrict network access to the E-Business Suite web tier using firewall rules, VPN gateways, or reverse proxy allowlists.
Disable public exposure of the Trade Management LOV endpoints where the module is not required by external users.
Enforce URL filtering at the reverse proxy to reject unauthenticated requests to Trade Management paths until the patch is applied.

bash

# Example reverse proxy rule to block unauthenticated Trade Management LOV requests
location ~* /OA_HTML/.*(ozf|ClaimLine).* {
    if ($http_cookie !~* "oracle.uix") {
        return 403;
    }
    proxy_pass http://ebs_backend;
}