Path Traversal in GNU Wget
CVE-2014-4877
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.399 (98.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.399 · newest: 0.399 · change: 0.000
Affected products
- GNU Wget — versions 1.12, 1.13, 1.13.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- git.savannah.gnu.org/cgit/wget.git/commit/ (Patch)
- security.gentoo.org/glsa/glsa-201411-05.xml (vendor-advisory)
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay
- lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html (mailing-list, Patch)
- www.ubuntu.com/usn/USN-2393-1 (vendor-advisory)
- www.mandriva.com/security/advisories (vendor-advisory)
- rhn.redhat.com/errata/RHSA-2014-1955.html (vendor-advisory)
- www.debian.org/security/2014/dsa-3062 (vendor-advisory)
- git.savannah.gnu.org/cgit/wget.git/commit/
- www.kb.cert.org/vuls/id/685996 (US Government Resource, Patch, third-party-advisory)
Frequently asked questions
- What is CVE-2014-4877?
- CVE-2014-4877 is a vulnerability in GNU Wget, classified under Path Traversal. Published 2014-10-29.
- Is CVE-2014-4877 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.