CVE-2024-21267: Oracle E-Business Suite Auth Bypass Flaw

CVE-2024-21267 Overview

CVE-2024-21267 is an authorization flaw in the Cost Planning component of Oracle Cost Management, part of Oracle E-Business Suite. The vulnerability affects supported versions 12.2.12 through 12.2.13. An authenticated attacker with low privileges and network access over HTTP can compromise the module without user interaction. Successful exploitation grants unauthorized read, create, delete, or modify access to all Cost Management data. Oracle addressed the issue in the October 2024 Critical Patch Update.

Critical Impact
A low-privileged remote attacker can read and alter all data accessible to Oracle Cost Management, undermining the integrity of financial cost planning records.

Affected Products

Oracle E-Business Suite 12.2.12
Oracle E-Business Suite 12.2.13
Oracle Cost Management (Cost Planning component)

Discovery Timeline

2024-10-15 - CVE-2024-21267 published to NVD
2024-10-15 - Oracle releases fix in the October 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21267

Vulnerability Analysis

The flaw resides in the Cost Planning component of Oracle Cost Management. It is classified under [CWE-863: Incorrect Authorization]. The Cost Planning component fails to correctly enforce authorization checks on HTTP requests submitted by authenticated users. As a result, a user holding only low-privilege credentials can invoke functions and access records that should be restricted to higher-privileged roles.

The vulnerability affects confidentiality and integrity at a high level, while availability is not impacted. Attackers can read all Cost Management data, and also create, delete, or modify records. In an environment where Cost Management supports downstream financial reporting, manipulation of cost data can propagate into general ledger entries and inventory valuation.

Exploitation requires network access to the Oracle E-Business Suite web tier and valid credentials for any low-privilege account. No social engineering or user interaction is required. The EPSS probability for exploitation stands at 0.441%.

Root Cause

The root cause is missing or incomplete authorization validation within one or more Cost Planning request handlers. The application trusts the session's authentication state without independently verifying that the acting principal is permitted to perform the requested action on the target object.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite application tier. An attacker authenticates with any low-privilege account and then issues crafted requests to Cost Planning endpoints. Because authorization is not enforced correctly, the server returns or accepts data beyond the account's assigned role. No verified public exploit code is available. See the Oracle Critical Patch Update - October 2024 for advisory details.

Detection Methods for CVE-2024-21267

Indicators of Compromise

Unexpected HTTP requests to Cost Planning URIs originating from user accounts that do not typically use the module.
Audit records showing create, update, or delete operations on Cost Management objects by users outside the Cost Management responsibility set.
Bulk data reads from Cost Planning tables by low-privilege application users within short time windows.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record which users accessed Cost Planning pages.
Correlate application-tier access logs with database audit logs to identify authorization anomalies against Cost Management tables.
Baseline normal Cost Planning usage by responsibility, then alert on deviations by user, source IP, or request volume.

Monitoring Recommendations

Forward Oracle E-Business Suite access_log and application audit records to a centralized SIEM for correlation.
Monitor HTTP responses returning large payloads from Cost Planning endpoints to non-Cost Management users.
Track privilege assignments to detect any unauthorized granting of Cost Management responsibilities.

How to Mitigate CVE-2024-21267

Immediate Actions Required

Apply the October 2024 Oracle Critical Patch Update to Oracle E-Business Suite 12.2.12 and 12.2.13 environments.
Inventory all E-Business Suite instances and confirm the patch level for the Cost Management module.
Review recent Cost Planning audit logs for signs of unauthorized data access or modification prior to patching.

Patch Information

Oracle released the fix as part of the Oracle Critical Patch Update - October 2024. Administrators must download and apply the Cost Management patches referenced in the advisory to the affected 12.2.x releases. Patching should be validated in a non-production environment before deployment.

Workarounds

Restrict network access to the E-Business Suite application tier so that only trusted internal networks and VPN users can reach Cost Planning endpoints.
Review and tighten responsibility assignments so low-privilege accounts do not retain unnecessary access to the Cost Management module.
Enable Oracle E-Business Suite auditing on Cost Management tables to increase visibility until the patch is deployed.

bash

# Example: verify Cost Management patch level in Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_OCT2024_BUG_NUMBER>');
EOF