Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2014-4877 Details

Description

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://advisories.mageia.org/MGASA-2014-0431.html	CVE
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7	CVE
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0	CVE	Patch
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html	CVE	Patch
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html	CVE
http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html	CVE
http://rhn.redhat.com/errata/RHSA-2014-1764.html	CVE
http://rhn.redhat.com/errata/RHSA-2014-1955.html	CVE
https://bugzilla.redhat.com/show_bug.cgi?id=1139181	CVE	Patch
https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access	CVE	Exploit
http://security.gentoo.org/glsa/glsa-201411-05.xml	CVE
https://github.com/rapid7/metasploit-framework/pull/4088	CVE	Exploit
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917	CVE
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722	CVE
https://kc.mcafee.com/corporate/index?page=content&id=SB10106	CVE
http://www.debian.org/security/2014/dsa-3062	CVE
http://www.kb.cert.org/vuls/id/685996	CVE	PatchUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2015:121	CVE
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html	CVE
http://www.securityfocus.com/bid/70751	CVE
http://www.ubuntu.com/usn/USN-2393-1	CVE
http://advisories.mageia.org/MGASA-2014-0431.html	[email protected]
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7	[email protected]
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0	[email protected]	Patch
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html	[email protected]	Patch
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html	[email protected]
http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html	[email protected]
http://rhn.redhat.com/errata/RHSA-2014-1764.html	[email protected]
http://rhn.redhat.com/errata/RHSA-2014-1955.html	[email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=1139181	[email protected]	Patch
https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access	[email protected]	Exploit
http://security.gentoo.org/glsa/glsa-201411-05.xml	[email protected]
https://github.com/rapid7/metasploit-framework/pull/4088	[email protected]	Exploit
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917	[email protected]
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722	[email protected]
https://kc.mcafee.com/corporate/index?page=content&id=SB10106	[email protected]
http://www.debian.org/security/2014/dsa-3062	[email protected]
http://www.kb.cert.org/vuls/id/685996	[email protected]	PatchUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2015:121	[email protected]
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html	[email protected]
http://www.securityfocus.com/bid/70751	[email protected]
http://www.ubuntu.com/usn/USN-2393-1	[email protected]

see all 44 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
gnu wget	<= 1.15 1.12 1.13 1.13.1 1.13.2
CPE cpe:2.3:a:gnu:wget:::::::: cpe:2.3:a:gnu:wget:1.12:::::::* cpe:2.3:a:gnu:wget:1.13:::::::* cpe:2.3:a:gnu:wget:1.13.1:::::::* cpe:2.3:a:gnu:wget:1.13.2:::::::* cpe:2.3:a:gnu:wget:1.13.3:::::::* cpe:2.3:a:gnu:wget:1.13.4:::::::* cpe:2.3:a:gnu:wget:1.14:::::::* Remediation No remediation found in references.

Change History

15 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
May 6, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 17, 2017	CVE Modified	[email protected]
Jan 26, 2017	CVE Modified	[email protected]
Jan 20, 2017	CVE Modified	[email protected]
Jan 3, 2017	CVE Modified	[email protected]
Oct 26, 2016	CVE Modified	[email protected]
Apr 3, 2015	CVE Modified	[email protected]
Dec 7, 2014	CVE Modified	[email protected]
Nov 21, 2014	CVE Modified	[email protected]
Nov 20, 2014	CVE Modified	[email protected]
Nov 14, 2014	CVE Modified	[email protected]
Oct 29, 2014	Initial Analysis	[email protected]