CVE-2004-1488

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-04-27 · updated 2026-06-16

Description

wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.

Affected products

gnuwget wget: 1.8, 1.8.1, 1.8.2, 1.9, 1.9.1

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755
http://marc.info/?l=bugtraq&m=110269474112384&w=2
http://secunia.com/advisories/20960
http://securitytracker.com/id?1012472
http://www.novell.com/linux/security/advisories/2006_16_sr.html
http://www.redhat.com/support/errata/RHSA-2005-771.html
http://www.securityfocus.com/bid/11871
https://exchange.xforce.ibmcloud.com/vulnerabilities/18421
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9750
https://usn.ubuntu.com/145-1/
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755
http://marc.info/?l=bugtraq&m=110269474112384&w=2

Get alerted when CVE-2004-1488 or the next vulnerability affects your stack