CVE-2024-21077: Oracle Trade Management Info Disclosure

CVE-2024-21077 Overview

CVE-2024-21077 is an information disclosure vulnerability in the Oracle Trade Management product of Oracle E-Business Suite, specifically within the GL Accounts LOV (List of Values) component. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. Oracle addressed the issue in the April 2024 Critical Patch Update. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated remote attackers can read sensitive Oracle Trade Management data over HTTP without user interaction, exposing financial and account information.

Affected Products

Oracle E-Business Suite — Oracle Trade Management version 12.2.3
Oracle E-Business Suite — Oracle Trade Management versions 12.2.4 through 12.2.12
Oracle E-Business Suite — Oracle Trade Management version 12.2.13

Discovery Timeline

2024-04-16 - Oracle published the vulnerability advisory and CVE-2024-21077 in the April 2024 Critical Patch Update
2024-04-16 - CVE-2024-21077 published to NVD
2025-03-28 - Last updated in NVD database

Technical Details for CVE-2024-21077

Vulnerability Analysis

The vulnerability resides in the GL Accounts LOV (List of Values) component of Oracle Trade Management, a module within Oracle E-Business Suite that manages channel revenue, claims, and trade funds. The GL Accounts LOV is responsible for displaying general ledger account selections to users. An attacker can interact with this component over HTTP without authentication and retrieve data they should not be authorized to view.

The issue is an information disclosure flaw mapped to [CWE-200]. Successful exploitation does not impact integrity or availability, but it grants the attacker read access to confidential data accessible by Oracle Trade Management. Because the attack vector is network-based and requires no privileges or user interaction, the flaw is exploitable directly against any internet-exposed Oracle E-Business Suite instance.

Root Cause

The root cause is insufficient access control on the GL Accounts LOV endpoint. The component fails to validate the requesting session and authorization context before returning data. Without server-side enforcement of authentication on this list-of-values lookup, the endpoint returns confidential general ledger and trade management data to anonymous callers.

Attack Vector

An attacker reaches the affected endpoint over HTTP across the network. No credentials, prior compromise, or victim interaction are required. The attacker issues crafted HTTP requests to the Oracle Trade Management GL Accounts LOV endpoint and receives confidential data in the response. Oracle has not released technical details, and no public proof-of-concept is currently available for CVE-2024-21077.

Detection Methods for CVE-2024-21077

Indicators of Compromise

Unauthenticated HTTP requests targeting Oracle Trade Management GL Accounts LOV endpoints within Oracle E-Business Suite (/OA_HTML/ URL paths).
High volumes of LOV (List of Values) lookup requests from a single source IP without prior authentication cookies or session tokens.
Anomalous outbound data transfers from Oracle E-Business Suite application tier servers correlated with HTTP requests to Trade Management URLs.

Detection Strategies

Inspect Oracle HTTP Server and application tier access logs for unauthenticated requests to Oracle Trade Management LOV endpoints, particularly those returning large response bodies.
Deploy WAF rules that flag requests to E-Business Suite endpoints lacking valid ICX_SESSION cookies or other expected authentication artifacts.
Correlate database audit logs with web tier logs to identify queries against general ledger account tables triggered by unauthenticated web sessions.

Monitoring Recommendations

Enable Oracle E-Business Suite Fine-Grained Auditing (FGA) on general ledger and Trade Management tables to record unexpected read operations.
Monitor for spikes in HTTP 200 responses to Trade Management URLs from external or untrusted network segments.
Track EPSS scoring trends and Oracle security advisories for any updated exploitation likelihood for CVE-2024-21077.

How to Mitigate CVE-2024-21077

Immediate Actions Required

Apply the patches delivered in the Oracle Critical Patch Update April 2024 for all affected Oracle E-Business Suite 12.2.3–12.2.13 deployments.
Inventory all Oracle E-Business Suite instances and confirm whether the Oracle Trade Management module is licensed and deployed.
Restrict network access to E-Business Suite application tiers so that only trusted networks can reach HTTP endpoints, reducing internet exposure.

Patch Information

Oracle released the fix for CVE-2024-21077 in the April 2024 Critical Patch Update. Administrators must apply the Oracle E-Business Suite 12.2 patch set bundled in that advisory. Refer to the Oracle Security Alert April 2024 for patch numbers, prerequisites, and version-specific guidance.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or WAF and block unauthenticated requests to Trade Management GL Accounts LOV URLs until patches are applied.
Limit access to Oracle E-Business Suite to authenticated VPN users where business workflows permit, eliminating direct internet exposure of the HTTP tier.
Disable the Oracle Trade Management responsibility for users that do not require it, reducing the attack surface even though this does not fully remediate the unauthenticated path.

bash

# Example: restrict access to Oracle Trade Management LOV endpoints at the reverse proxy
# (Apache httpd in front of Oracle E-Business Suite)
<LocationMatch "/OA_HTML/.*GLAccount.*LOV.*">
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</LocationMatch>