CVE-2014-2399

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 7.0%

from disclosure to weapon72 days

Published on NVDApr 16

1st PoC+72d

exploitation probability

7.0%top 7% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/33897 cve_referencepacketstormsecurity.com/files/127222/Endeca-Latitude-2.2.2-Cross-Site-Request-Forgery.htmlunverified cve_referencewww.exploit-db.com/exploits/33897unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/127222/Endeca-Latitude-2.2.2-Cross-Site-Request-Forgery.html http://seclists.org/fulldisclosure/2014/Jun/123 http://www.exploit-db.com/exploits/33897 http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html http://www.securityfocus.com/archive/1/532556/100/0/threaded http://www.securityfocus.com/bid/66864