CVE-2014-4877
- State
- Published
- Severity
- Not scored
- Published
- Oct 29, 2014
- Updated
- Aug 6, 2024
- Reserved
- Jul 10, 2014
Description
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0
- GLSA-201411-05vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
- [bug-wget] 20141027 GNU wget 1.16 releasedmailing-list
- USN-2393-1vendor-advisory
- MDVSA-2015:121vendor-advisory
- RHSA-2014:1955vendor-advisory
- DSA-3062vendor-advisory
- http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7
- VU#685996third-party-advisory
- SUSE-SU-2014:1366vendor-advisory
- RHSA-2014:1764vendor-advisory
- SUSE-SU-2014:1408vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- openSUSE-SU-2014:1380vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1139181
- https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- 70751vdb-entry
- https://kc.mcafee.com/corporate/index?page=content&id=SB10106
- http://advisories.mageia.org/MGASA-2014-0431.html
- https://github.com/rapid7/metasploit-framework/pull/4088
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.