CVE-2014-2424
published 2014-04-16CVE-2014-2424: Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity…
PriorityP337medium4CVSS 2.0
AVNACLAuSCNIPAN
EXPLOIT
EPSS
48.35%
98.7th percentile
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | git_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| oracle | fusion_middleware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle Event Processing FileUploadServlet Arbitrary File Upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wlevs/visualizer/upload"; http.request_body; content:"filename"; pcre:"/^\s*?=\s*?[\x22\x27]?[^&]*?(?:%(?:25)?2e(?:%(?:(?:25)?2e(?:%(?:25)?5c|\/|\\)|2e(?:25)?%(?:25)?2f)|\.(?:%(?:25)?(?:2f|5c)|\/|\\))|\.(?:%(?:25)?2e(?:%(?:25)?(?:2f|5c)|\/|\\)|\.(?:%(?:25)?(?:2f|5c)|\/|\\)))/Ri"; reference:url,www.exploit-db.com/exploits/33989/; reference:cve,2014-2424; classtype:web-application-attack; sid:2018652; rev:4; metadata:created_at 2014_07_08, cve CVE_2014_2424, signature_severity Major, updated_at 2020_04_30;)
- →The vulnerable upload endpoint requires no authentication. Detect unauthenticated POST requests to /wlevs/visualizer/upload containing a multipart filename field with directory traversal sequences (e.g., ../, URL-encoded variants %2e%2e%2f, %2e%2e%5c). ↗
- →Check for version fingerprinting requests to /ohw/help/state with query parameters navSetId=cepvi&navId=0 — this is the check method used by the Metasploit module to confirm a vulnerable target. ↗
- →Default upload storage path on disk is C:\Oracle\Middleware\user_projects\domains\<domain>\defaultserver\upload\ — monitor for unexpected files or traversal artifacts relative to this directory. ↗
- →The exploit uses a default traversal depth of 7 (../../../../../../..) to escape the upload directory. Alert on filename fields in multipart POST bodies to /wlevs/visualizer/upload containing 7 or more ../ sequences. ↗
- ·The WbemExec post-exploitation technique (dropping .mof + .exe) only works on Windows 2003 SP2 or older; the module does not support newer Windows targets. ↗
- ·Oracle Event Processing uses Jetty without JSP support by default, so JSP webshell uploads will not execute — the attack is constrained to filesystem-write techniques like WbemExec. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle Event Processing 11.1.1.7.0 CEP System (EDB-33989 / SBV-44078)
vuldb·2026-05-11·CVSS 4.0
CVE-2014-2424 [MEDIUM] Oracle Event Processing 11.1.1.7.0 CEP System (EDB-33989 / SBV-44078)
A vulnerability was found in Oracle Event Processing 11.1.1.7.0 and classified as problematic. The affected element is an unknown function of the component CEP System. Executing a manipulation can lead to an unknown weakness.
This vulnerability appears as CVE-2014-2424. The attack may be performed from remote. In addition, an exploit is available.
It is suggested to upgrade the affected component.
GHSA
GHSA-vjc7-vhmq-3cwg: Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11
ghsa_unreviewed·2022-05-17
CVE-2014-2424 [MEDIUM] GHSA-vjc7-vhmq-3cwg: Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.
Suricata
ET WEB_SPECIFIC_APPS Oracle Event Processing FileUploadServlet Arbitrary File Upload
suricata·2014-07-08
CVE-2014-2424 ET WEB_SPECIFIC_APPS Oracle Event Processing FileUploadServlet Arbitrary File Upload
ET WEB_SPECIFIC_APPS Oracle Event Processing FileUploadServlet Arbitrary File Upload
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle Event Processing FileUploadServlet Arbitrary File Upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wlevs/visualizer/upload"; http.request_body; content:"filename"; pcre:"/^\s*?=\s*?[\x22\x27]?[^&]*?(?:%(?:25)?2e(?:%(?:(?:25)?2e(?:%(?:25)?5c|\/|\\)|2e(?:25)?%(?:25)?2f)|\.(?:%(?:25)?(?:2f|5c)|\/|\\))|\.(?:%(?:25)?2e(?:%(?:25)?(?:2f|5c)|\/|\\)|\.(?:%(?:25)?(?:2f|5c)|\/|\\)))/Ri"; reference:url,www.exploit-db.com/exploits/33989/; reference:cve,2014-2424; classtype:web-application-attack; sid:2018652; rev:4; metadata:created_at 2014_07_08, cve CVE_2014_2424, signature_severity Major, u
Exploit-DB
Oracle Event Processing FileUploadServlet - Arbitrary File Upload (Metasploit)
exploitdb·2014-07-07
CVE-2014-2424 Oracle Event Processing FileUploadServlet - Arbitrary File Upload (Metasploit)
Oracle Event Processing FileUploadServlet - Arbitrary File Upload (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Oracle Event Processing FileUploadServlet Arbitrary File Upload',
'Description' => %q{
This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing
11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be
abused to upload a malicious file onto an arbitrary location due to a directory traversal
flaw, and compromise the server. By default Oracle Event Processing uses a Jetty
Application Server without JSP support, which limits the attack to WbemExec. The current
WbemExec technique
Metasploit
Oracle Event Processing FileUploadServlet Arbitrary File Upload
metasploit
Oracle Event Processing FileUploadServlet Arbitrary File Upload
Oracle Event Processing FileUploadServlet Arbitrary File Upload
This module exploits an arbitrary file upload vulnerability in Oracle Event Processing 11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be abused to upload a malicious file onto an arbitrary location due to a directory traversal flaw, and compromise the server. By default Oracle Event Processing uses a Jetty Application Server without JSP support, which limits the attack to WbemExec. The current WbemExec technique only requires arbitrary write to the file system, but at the moment the module only supports Windows 2003 SP2 or older.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/127365/Oracle-Event-Processing-FileUploadServlet-Arbitrary-File-Upload.htmlhttp://www.exploit-db.com/exploits/33989http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.htmlhttp://www.osvdb.org/105844http://www.securityfocus.com/bid/66871http://packetstormsecurity.com/files/127365/Oracle-Event-Processing-FileUploadServlet-Arbitrary-File-Upload.htmlhttp://www.exploit-db.com/exploits/33989http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.htmlhttp://www.osvdb.org/105844http://www.securityfocus.com/bid/66871
2014-04-16
Published