Oracle Event Processing CVE-2014-2424 Unspecified Vulnerability (April 2014 CPU)
medium Nessus Plugin ID 74151
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote host is affected by an unspecified remote directory traversal vulnerability.Description
The remote host is missing a vendor supplied security update that fixes an unspecified security vulnerability that allows authenticated attackers to create files outside of the intended path by utilizing a directory traversal string.Solution
Apply the Oracle April 2014 Critical Patch Update.See Also
Plugin Details
Severity: Medium
ID: 74151
File Name: oracle_cep_cve_2014_2424.nbin
Version: 1.167
Type: local
Family: Misc.
Published: 5/20/2014
Updated: 1/14/2022
Dependencies: oracle_event_processing_installed.nbin
Risk Information
VPR
Risk Factor: Medium
Score: 4
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.3
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Temporal Vector: E:F/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:fusion_middleware
Required KB Items: Oracle/OEP/Installed
Exploit Available: true
Exploit Ease: Exploits are available
Exploitable With
Metasploit (Oracle Event Processing FileUploadServlet Arbitrary File Upload)
Reference Information
CVE: CVE-2014-2424
BID: 66871