CVE-2004-1946

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-04-19 · updated 2026-06-16

Description

Format string vulnerability in the PRINT_ERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string specifiers in the -C command line argument. NOTE: it is not clear whether this issue could be exploited remotely, or if Cherokee is running at escalated privileges. Therefore it might not be a vulnerability.

Affected products

Cherokee Httpd: 0.4.16

References

http://marc.info/?l=bugtraq&m=108249818308672&w=2
http://www.nosystem.com.ar/advisories/advisory-03.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/15924
http://marc.info/?l=bugtraq&m=108249818308672&w=2
http://www.nosystem.com.ar/advisories/advisory-03.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/15924

Get alerted when CVE-2004-1946 or the next vulnerability affects your stack