CVE-2014-2399

🗓️ 16 Apr 2014 01:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

Unspecified vulnerability in Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2

Reporter	Title	Published	Views	Family All 13
zdt	Endeca Latitude 2.2.2 - CSRF Vulnerability	27 Jun 201400:00	–	zdt
Circl	CVE-2014-2399	27 Jun 201400:00	–	circl
Cvelist	CVE-2014-2399	16 Apr 201401:00	–	cvelist
Exploit DB	Endeca Latitude 2.2.2 - Cross-Site Request Forgery	27 Jun 201400:00	–	exploitdb
exploitpack	Endeca Latitude 2.2.2 - Cross-Site Request Forgery	27 Jun 201400:00	–	exploitpack
NVD	CVE-2014-2399	16 Apr 201401:55	–	nvd
Oracle	Oracle Critical Patch Update - April 2014	15 Apr 201400:00	–	oracle
Oracle	Oracle Critical Patch Update - April 2014	15 Apr 201400:00	–	oracle
Packet Storm	Endeca Latitude 2.2.2 Cross Site Request Forgery	25 Jun 201400:00	–	packetstorm
Prion	Design/Logic Flaw	16 Apr 201401:55	–	prion

NVD

Node

Source	Link
securityfocus	www.securityfocus.com/bid/66864
securityfocus	www.securityfocus.com/archive/1/532556/100/0/threaded
packetstormsecurity	www.packetstormsecurity.com/files/127222/Endeca-Latitude-2.2.2-Cross-Site-Request-Forgery.html
oracle	www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
exploit-db	www.exploit-db.com/exploits/33897
seclists	www.seclists.org/fulldisclosure/2014/Jun/123

Parameter	Position	Path	Description	CWE
op	query param	admin?op=exit	CSRF-prone admin action endpoint to shut down the Endeca Latitude instance.	CWE-352
op	query param	config?op=log-disable	CSRF-prone admin action endpoint to disable logging configuration.	CWE-352

17 Jun 2026 00:06Current

5.7Medium risk

Vulners AI Score5.7

CVSS 24.3

EPSS0.0698