CVE-2024-21078: Oracle Marketing Information Disclosure

CVE-2024-21078 Overview

CVE-2024-21078 is a high-severity vulnerability in the Oracle Marketing product within Oracle E-Business Suite. The flaw resides in the Campaign LOV (List of Values) component and affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue to gain unauthorized access to sensitive Oracle Marketing data. Oracle disclosed the vulnerability in the April 2024 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can read all data accessible to Oracle Marketing, resulting in complete confidentiality compromise of campaign records and related business information.

Affected Products

Oracle E-Business Suite — Oracle Marketing version 12.2.3
Oracle E-Business Suite — Oracle Marketing versions 12.2.4 through 12.2.12
Oracle E-Business Suite — Oracle Marketing version 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21078 published to NVD following Oracle's April 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21078

Vulnerability Analysis

The vulnerability exists in the Campaign LOV component of Oracle Marketing. Campaign LOV endpoints supply List of Values data used to populate marketing campaign interfaces. The flaw allows an unauthenticated remote attacker to query these endpoints over HTTP and retrieve data they should not be able to access. Oracle classifies the impact as confidentiality-only, with no integrity or availability effects. Successful exploitation yields unauthorized access to critical data or complete access to all Oracle Marketing accessible data.

The issue is categorized under [CWE NVD-CWE-noinfo] because Oracle does not publish detailed root-cause analysis for Critical Patch Update vulnerabilities. Based on the CVSS profile and component description, the weakness aligns with an information disclosure class of bug in a web-facing list-of-values handler.

Root Cause

Oracle has not published the root-cause detail. The affected component, Campaign LOV, is a backend handler that returns reference data for Oracle Marketing campaign user interfaces. The combination of network reachability, no authentication requirement, and high confidentiality impact indicates missing authorization or input validation on a publicly reachable Marketing endpoint.

Attack Vector

An attacker reaches the Oracle Marketing module over HTTP without credentials and submits crafted requests to the Campaign LOV component. No user interaction is required. Because Oracle E-Business Suite deployments often expose Marketing modules to partners or the internet for campaign management, exposed instances can be discovered through standard web reconnaissance.

No verified public proof-of-concept code is available for CVE-2024-21078. Refer to the Oracle Security Alert April 2024 for vendor-supplied technical context.

Detection Methods for CVE-2024-21078

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Marketing Campaign LOV endpoints originating from external or unexpected source addresses.
Anomalous volumes of LOV query responses returning campaign, customer, or list data to unauthenticated sessions.
Web access logs showing repeated requests to Oracle Marketing URLs without an associated authenticated session cookie.

Detection Strategies

Review Oracle E-Business Suite access logs for requests to Marketing module paths that lack valid ICX_SESSION cookies or E-Business Suite authentication context.
Correlate web application firewall logs with backend Oracle Marketing audit events to identify unauthenticated data retrieval patterns.
Compare current Oracle Marketing patch level against the April 2024 Critical Patch Update baseline to confirm exposure.

Monitoring Recommendations

Enable verbose access logging on the Oracle HTTP Server fronting E-Business Suite and forward to a centralized log platform.
Alert on bursts of HTTP GET requests targeting Marketing LOV servlets from a single source over short intervals.
Track outbound data transfer volume from the Oracle Marketing tier to identify bulk extraction attempts.

How to Mitigate CVE-2024-21078

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update to all Oracle E-Business Suite environments running Oracle Marketing versions 12.2.3 through 12.2.13.
Inventory all internet-exposed Oracle E-Business Suite deployments and restrict public access to the Marketing module pending patch deployment.
Audit Oracle Marketing access logs for indications of unauthenticated data retrieval since April 2024.

Patch Information

Oracle released the fix as part of the April 2024 Critical Patch Update. Administrators must download and apply the patches referenced in the Oracle Security Alert April 2024 for the affected Oracle E-Business Suite 12.2 releases. Oracle does not provide workarounds outside the Critical Patch Update process and recommends applying patches immediately.

Workarounds

Place Oracle E-Business Suite behind an authenticated reverse proxy or VPN to remove unauthenticated network access to Marketing endpoints.
Use URL filtering on the Oracle HTTP Server or upstream web application firewall to block external requests to Campaign LOV paths until the patch is applied.
Disable the Oracle Marketing module if it is not in active use and confirm dependent modules are unaffected before doing so.

bash

# Example: restrict Oracle Marketing Campaign LOV endpoints at the Oracle HTTP Server level
# Add to httpd.conf or a virtual host include and reload the server
<LocationMatch "^/OA_HTML/.*Campaign.*LOV.*">
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</LocationMatch>