CVE-2024-21143: Oracle iStore Information Disclosure Flaw

CVE-2024-21143 Overview

CVE-2024-21143 is an information disclosure vulnerability in the Oracle iStore product of Oracle E-Business Suite, specifically within the User Management component. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized read access to a subset of Oracle iStore accessible data. Oracle addressed the issue in the July 2024 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can read a subset of data accessible to Oracle iStore over HTTP without any user interaction.

Affected Products

Oracle iStore version 12.2.3
Oracle iStore versions 12.2.4 through 12.2.12
Oracle iStore version 12.2.13

Discovery Timeline

2024-07-16 - CVE-2024-21143 published to the National Vulnerability Database (NVD)
July 2024 - Oracle releases fix in the Oracle Critical Patch Update July 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21143

Vulnerability Analysis

The vulnerability resides in the User Management component of Oracle iStore, a customer-facing web storefront module within Oracle E-Business Suite. The flaw allows an unauthenticated remote attacker to interact with an exposed HTTP interface and retrieve confidential data. The impact is limited to confidentiality; integrity and availability are not affected. The Common Weakness Enumeration classification includes [CWE-125] Out-of-Bounds Read alongside NVD-CWE-noinfo, indicating limited public technical detail. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.402% as of 2026-09-07, and there are no public proof-of-concept exploits or CISA Known Exploited Vulnerabilities (KEV) entries associated with this CVE.

Root Cause

Oracle has not published low-level technical details for this issue. Based on the CWE mapping and vendor advisory, the root cause involves improper access control within the iStore User Management component, allowing anonymous HTTP requests to reach data that should require authentication or authorization checks. The vulnerability requires no privileges, no user interaction, and low attack complexity.

Attack Vector

Exploitation occurs over the network via HTTP against an internet-facing or intranet-facing Oracle iStore deployment. An attacker crafts requests targeting the vulnerable User Management endpoints of Oracle E-Business Suite. Because authentication is not required, any host able to reach the iStore application can attempt exploitation. Successful attacks return a subset of Oracle iStore accessible data to the attacker.

No verified public exploit code is available for CVE-2024-21143. Refer to the Oracle Critical Patch Update July 2024 advisory for authoritative remediation guidance.

Detection Methods for CVE-2024-21143

Indicators of Compromise

Unauthenticated HTTP requests to Oracle iStore User Management URIs originating from unexpected external IP addresses.
Anomalous spikes in successful HTTP 200 responses from iStore endpoints without a preceding authentication flow.
Unusual session identifiers or missing authentication cookies on requests that return user or account data.

Detection Strategies

Inspect Oracle HTTP Server and application-tier access logs for patterns of anonymous requests to iStore User Management resources.
Deploy web application firewall (WAF) rules that flag unauthenticated access attempts to sensitive iStore endpoints.
Correlate outbound data volumes from the iStore application tier with expected baselines to identify data exfiltration.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web server logs to a centralized analytics platform for correlation.
Monitor for repeated access to iStore data endpoints from a single source IP across short time windows.
Alert on requests that bypass expected referer chains or omit session cookies while retrieving iStore data.

How to Mitigate CVE-2024-21143

Immediate Actions Required

Apply the July 2024 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running iStore versions 12.2.3 through 12.2.13.
Inventory internet-exposed Oracle iStore instances and prioritize patching public-facing systems first.
Review web server and application logs for suspicious anonymous access to iStore resources dating back to July 2024.

Patch Information

Oracle released a fix for CVE-2024-21143 as part of the July 2024 Critical Patch Update. Administrators should follow the guidance in the Oracle Critical Patch Update July 2024 advisory and apply the appropriate patch level for their supported Oracle E-Business Suite release.

Workarounds

Restrict network access to Oracle iStore User Management endpoints using firewall rules, reverse proxy allowlists, or WAF policies where the patch cannot be applied immediately.
Place internet-facing Oracle E-Business Suite tiers behind an authenticating reverse proxy to block unauthenticated requests at the perimeter.
Disable the Oracle iStore module if it is not used by the business until patching is complete.

bash

# Example: block anonymous HTTP requests to iStore User Management paths at a reverse proxy
# (Adjust paths and rules to match your Oracle E-Business Suite deployment)
location ~* ^/OA_HTML/(ibe|jtf).*UserManagement.* {
    if ($http_cookie !~* "oracle.uix=") {
        return 403;
    }
    proxy_pass http://ebs_backend;
}