Unscored severity · published Apr 27, 2005
CVE-2004-1488
wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal…
–
CVSS
11.9%
EPSS
No
On KEV
Description
wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)11.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
Wget · Gnu
1.8; 1.8.1; 1.8.2; 1.9; 1.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1488
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1488
Exploit
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755
marc.info
http://marc.info/?l=bugtraq&m=110269474112384&w=2
secunia.com
http://secunia.com/advisories/20960
securitytracker.com
http://securitytracker.com/id?1012472
www.novell.com
http://www.novell.com/linux/security/advisories/2006_16_sr.html
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2005-771.html
More from Wget
9.8
CVE-2019-5953
Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors
9.1
CVE-2024-38428
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the…
8.8
CVE-2017-13090
The retr.c:fd_read_body() function is called when processing OK responses
8.8
CVE-2017-13089
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects
8.8
CVE-2016-4971
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource