CVE-2024-21258: Oracle Installed Base Information Disclosure

CVE-2024-21258 Overview

CVE-2024-21258 is an information disclosure vulnerability in the Oracle Installed Base product of Oracle E-Business Suite. The flaw resides in the User Interface component and affects supported versions 12.2.3 through 12.2.14. An unauthenticated attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation grants unauthorized read access to a subset of Oracle Installed Base data. Oracle addressed the issue in the October 2024 Critical Patch Update. The CWE classification is [CWE-922] Insecure Storage of Sensitive Information.

Critical Impact
Remote, unauthenticated attackers can read a subset of Oracle Installed Base data over HTTP, exposing sensitive asset and customer records without leaving authentication traces.

Affected Products

Oracle E-Business Suite — Installed Base 12.2.3
Oracle E-Business Suite — Installed Base versions 12.2.4 through 12.2.13
Oracle E-Business Suite — Installed Base 12.2.14

Discovery Timeline

2024-10-15 - CVE-2024-21258 published to NVD as part of the Oracle Critical Patch Update
2024-10-15 - Oracle releases fix in the Oracle Critical Patch Update October 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21258

Vulnerability Analysis

The vulnerability lives in the User Interface component of Oracle Installed Base, a module in Oracle E-Business Suite that tracks customer-owned assets and installed products. An unauthenticated HTTP request reaches a resource that returns Installed Base records without enforcing the expected access controls. The scope is limited to confidentiality; the attacker cannot modify data or affect availability. Because no credentials are required, the vulnerability is reachable by any actor able to send HTTP traffic to the E-Business Suite front end. Internet-exposed EBS deployments are the highest-risk configuration.

Root Cause

The [CWE-922] classification points to insecure storage or handling of sensitive information within the Installed Base UI layer. A response path exposes data that should be gated behind session authentication and role checks. Oracle has not published a technical breakdown beyond the advisory summary.

Attack Vector

Exploitation requires only HTTP access to the vulnerable Oracle E-Business Suite instance. The attacker crafts a request targeting the affected Installed Base UI resource and parses the returned response for sensitive fields. No privileges, user interaction, or chaining with other vulnerabilities is needed. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.498%.

No verified proof-of-concept has been published. Refer to the Oracle Critical Patch Update October 2024 advisory for vendor-supplied technical context.

Detection Methods for CVE-2024-21258

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to Oracle Installed Base UI endpoints returning HTTP 200 responses containing asset, serial number, or customer data.
Anomalous outbound data volume from EBS application tier hosts to external IP addresses.
Repeated access to Installed Base resources from IP addresses that never previously interacted with the EBS front end.

Detection Strategies

Enable web server access logging on the Oracle HTTP Server tier and hunt for requests to Installed Base paths that lack an authenticated session cookie.
Compare current EBS version output against the fixed release levels listed in the October 2024 Critical Patch Update to identify unpatched systems.
Deploy a web application firewall rule that flags direct requests to Installed Base UI resources originating from untrusted networks.

Monitoring Recommendations

Forward Oracle HTTP Server, application server, and database audit logs to a centralized analytics platform for correlation.
Baseline normal request patterns to Installed Base endpoints and alert on deviations in volume, source geography, or user-agent strings.
Monitor perimeter firewall telemetry for direct exposure of EBS TCP ports to the public internet.

How to Mitigate CVE-2024-21258

Immediate Actions Required

Apply the October 2024 Critical Patch Update for Oracle E-Business Suite to all Installed Base deployments running versions 12.2.3 through 12.2.14.
Inventory internet-facing EBS instances and restrict public HTTP access to the Installed Base UI until patching is complete.
Review web server and application logs for suspicious unauthenticated access to Installed Base resources during the exposure window.

Patch Information

Oracle released the fix as part of the Oracle Critical Patch Update October 2024. Administrators should follow the standard EBS patching procedure, apply the associated Installed Base patch bundle, and validate the deployment against Oracle's post-installation checklist.

Workarounds

Place the Oracle E-Business Suite front end behind a reverse proxy or VPN that enforces authentication before requests reach the Installed Base UI.
Configure Oracle HTTP Server URL firewall rules to deny anonymous access to Installed Base UI paths for external clients.
Limit network reachability of the EBS application tier to trusted corporate ranges through firewall access control lists.

bash

# Configuration example: restrict Installed Base UI to internal networks via Oracle HTTP Server
<Location /OA_HTML/csi>
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Location>