CVE-2024-21266 Overview
CVE-2024-21266 is an authorization flaw [CWE-863] in the Oracle Advanced Pricing product within Oracle E-Business Suite, specifically affecting the Price List component. Supported versions 12.2.3 through 12.2.13 are affected. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Advanced Pricing. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Advanced Pricing accessible data. Oracle addressed the issue in the October 2024 Critical Patch Update.
Critical Impact
An authenticated attacker with low privileges can read and modify all data accessible through Oracle Advanced Pricing over the network, undermining pricing data integrity and confidentiality.
Affected Products
- Oracle E-Business Suite 12.2.3 through 12.2.13
- Oracle Advanced Pricing (Price List component)
- Deployments exposing Oracle E-Business Suite web endpoints over HTTP/HTTPS
Discovery Timeline
- 2024-10-15 - Oracle publishes the October 2024 Critical Patch Update addressing the issue
- 2024-10-15 - CVE-2024-21266 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21266
Vulnerability Analysis
The vulnerability resides in the Price List component of Oracle Advanced Pricing, a module of Oracle E-Business Suite. It is classified under [CWE-863] Incorrect Authorization, indicating that the application enforces authorization checks incorrectly for actions on Price List data. An authenticated user with minimal application privileges can invoke functionality that should be restricted to higher-privileged roles.
Oracle rates the impact as high for both confidentiality and integrity, with no impact on availability. Exploitation does not require user interaction and can be performed remotely over HTTP. The attack complexity is low, meaning no special conditions are required beyond valid low-privileged credentials.
At the time of publication, no public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability score is 0.441%.
Root Cause
The root cause is improper authorization enforcement on Price List operations within Oracle Advanced Pricing. The affected code paths accept requests from authenticated sessions without validating that the caller holds the required entitlements to view or mutate targeted pricing records. This allows lateral access across pricing data belonging to other users or organizations.
Attack Vector
Exploitation occurs over the network via HTTP against an exposed Oracle E-Business Suite instance. The attacker must possess valid low-privileged credentials to the application. Once authenticated, the attacker issues crafted requests to Advanced Pricing endpoints handling Price List operations to read, create, modify, or delete records that should be outside their authorization scope.
No verified exploit code has been published. See the Oracle Critical Patch Update - October 2024 for vendor guidance and patch references.
Detection Methods for CVE-2024-21266
Indicators of Compromise
- Unexpected creation, modification, or deletion of Price List records by low-privileged application accounts.
- HTTP requests to Oracle Advanced Pricing endpoints originating from user sessions that historically lack pricing responsibilities.
- Audit log entries showing bulk reads of Price List data outside normal business patterns.
- Anomalous session activity from accounts accessing pricing data belonging to organizations they do not own.
Detection Strategies
- Enable and review Oracle E-Business Suite audit trails on Advanced Pricing tables such as QP_LIST_HEADERS_B and related Price List objects.
- Correlate application-layer audit records with web server access logs to identify direct URL access to Advanced Pricing functions.
- Baseline expected Price List activity per role and alert on deviations, such as read or modify volumes that exceed historical norms.
Monitoring Recommendations
- Forward Oracle E-Business Suite application, database, and web tier logs to a centralized analytics platform for correlation.
- Monitor for privilege changes or role assignments that grant new access to Advanced Pricing responsibilities.
- Alert on failed and successful authentication events for low-privileged accounts followed by access to sensitive pricing endpoints.
How to Mitigate CVE-2024-21266
Immediate Actions Required
- Apply the fixes from the Oracle October 2024 Critical Patch Update to all affected E-Business Suite 12.2.3 through 12.2.13 environments.
- Inventory Oracle E-Business Suite instances and confirm patch level for the Advanced Pricing module.
- Review Advanced Pricing role assignments and remove unnecessary access for standard user accounts.
- Restrict network access to Oracle E-Business Suite web tiers to trusted management networks and VPN users where feasible.
Patch Information
Oracle released the fix as part of the Critical Patch Update Advisory published on October 15, 2024. Administrators should follow Oracle's patch deployment guidance for E-Business Suite 12.2, including running adop patching cycles against the affected environments. Consult the Oracle Critical Patch Update Advisory - October 2024 for the specific patch numbers and prerequisites for each supported version.
Workarounds
- Reduce exposure by placing Oracle E-Business Suite behind a web application firewall and restricting external HTTP access to Advanced Pricing URLs.
- Enforce least-privilege on E-Business Suite responsibilities so that only pricing administrators hold Advanced Pricing access.
- Rotate credentials for any accounts suspected of misuse and enable multi-factor authentication on the E-Business Suite front end where supported.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
