CVE-2014-4877
Last modified
CVE-2014-4877 is a vulnerability of currently unknown severity. Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.. EPSS estimates a 39.88% chance of exploitation in the next 30 days.
Description
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Wget | <= 1.15 |
| Gnu | Wget | 1.12 |
| Gnu | Wget | 1.13 |
| Gnu | Wget | 1.13.1 |
| Gnu | Wget | 1.13.2 |
| Gnu | Wget | 1.13.3 |
| Gnu | Wget | 1.13.4 |
| Gnu | Wget | 1.14 |
References
- http://www.kb.cert.org/vuls/id/685996Patch, US Government Resource
- http://www.kb.cert.org/vuls/id/685996Patch, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-4877?
How severe is CVE-2014-4877?
How do I fix CVE-2014-4877?
Are you affected by CVE-2014-4877?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST