Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2004-2014

CWE-78 — OS Command InjectionCWE-416 — Use After Free21 documents11 sources
Severity
2.6LOW
EPSS
0.2%
top 61.94%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
GNU Wget
Timeline
PublishedDec 31
Latest updateApr 29

Description

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

CVSS vector

AV:L/AC:H/C:N/I:P/A:PExploitability: 1.9 | Impact: 4.9

Affected Packages2 packages

▶Debianwget< 1.9.1-12+3
▶NVDgnu/wget9 versions+8

🔴Vulnerability Details

3
GHSA
GHSA-8ghf-v9f7-25jp: Wget 1↗2022-04-29
▶
CVEList
CVE-2004-2014: Wget 1↗2005-05-10
▶
OSV
CVE-2004-2014: Wget 1↗2004-12-31
▶

💥Exploits & PoCs

5
Exploit-DB
HP Data Protector A.09.00 - Arbitrary Command Execution↗2016-05-26
▶
Exploit-DB
EFS Easy Chat Server 3.1 - Remote Stack Buffer Overflow↗2014-05-12
▶
Exploit-DB
Snitz Forums 2000 - 'down.asp' HTTP Response Splitting↗2004-09-16
▶
Exploit-DB
WGet 1.x - Insecure File Creation Race Condition↗2004-05-17
▶
Nuclei
HP Data Protector - Arbitrary Command Execution
▶

📋Vendor Advisories

6
Red Hat
php: use after free vulnerability in unserialize()↗2014-12-18
▶
Red Hat
mailx: command execution flaw↗2014-12-16
▶
Red Hat
mailx: command execution flaw↗2014-12-16
▶
Ubuntu
wget vulnerabilities↗2005-06-28
▶
Red Hat
security flaw↗2004-05-16
▶

💬Community

3
Bugzilla
CVE-2004-2014 security flaw↗2018-08-16
▶
Bugzilla
CVE-2004-2771 CVE-2014-7844 nail: mailx: command execution flaw [epel-5]↗2014-12-17
▶
Bugzilla
CVE-2004-2771 CVE-2014-7844 mailx: command execution flaw↗2014-11-11
▶