Unscored severity · published Oct 29, 2014
CVE-2014-4877
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary…
–
CVSS
39.9%
EPSS
No
On KEV
Description
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Exploitation
Is it being used?
Exploit prediction (EPSS)39.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
Wget · Gnu
through 1.15; 1.12; 1.13; 1.13.1; 1.13.2; 1.13.3; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4877
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4877
advisories.mageia.org
http://advisories.mageia.org/MGASA-2014-0431.html
git.savannah.gnu.org
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7
Patch
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0
Patch
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html
More from Wget
9.8
CVE-2019-5953
Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors
9.1
CVE-2024-38428
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the…
8.8
CVE-2017-13090
The retr.c:fd_read_body() function is called when processing OK responses
8.8
CVE-2017-13089
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects
8.8
CVE-2016-4971
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource